hardening: migrate quicktree SQL helpers to prepared variants

[somethingwithproof]

Summary

• migrate selected plugin_quicktree SQL helper reads to prepared variants
• convert graph-tree list and max-sequence lookups in quicktree.php to prepared helpers
• convert plugin version lookup in setup.php to prepared helper
• preserve behavior with safe mechanical conversions

Tests

• php -l quicktree.php
• php -l setup.php
• php -l tests/test_prepared_statements.php
• php tests/test_prepared_statements.php

Closes #11

[Copilot]

Pull request overview

This PR hardens the plugin_quicktree plugin by migrating selected SQL read helpers from raw query helpers to prepared-statement variants, and adds a small regression script to verify the migration patterns remain in place.

Changes:

• Convert quicktree.php graph-tree list and max-sequence lookups to db_fetch_*_prepared.
• Convert setup.php plugin version lookup to db_fetch_cell_prepared.
• Add tests/test_prepared_statements.php to statically verify prepared-helper usage and absence of raw helper calls in the touched files.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
quicktree.php	Replaces specific raw read queries with prepared helper equivalents.
setup.php	Uses prepared helper for plugin version lookup during upgrade checks.
tests/test_prepared_statements.php	Adds regression checks (via regex) to enforce prepared-helper usage in updated files.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[somethingwithproof]

Incorporated follow-up review feedback in 3697e04. Added follow-up workflow checks for prepared queue fetch/cleanup and parameterized existing-tree branch lookup.

[somethingwithproof]

Converted to draft to serialize the stack in this repo. Blocked by #10; will un-draft after that merges to avoid cross-PR merge conflicts.