Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/cmd/migrator/sqlident_test.go

@@ -0,0 +1,42 @@
+package main
+
+import "testing"
+
+func TestQuoteMySQLIdent(t *testing.T) {
+	got, err := quoteMySQLIdent("order")
+	if err != nil || got != "`order`" {
+		t.Fatalf("order: got %q err=%v", got, err)
+	}
+	if _, err := quoteMySQLIdent("users; DROP TABLE x"); err == nil {
+		t.Fatal("expected reject for injection payload")
+	}
+	if _, err := quoteMySQLIdent("a-b"); err == nil {
+		t.Fatal("expected reject for hyphen")
+	}
+}
+
+func TestQuoteMySQLIdentPath(t *testing.T) {
+	got, err := quoteMySQLIdentPath("cf.company_id")
+	if err != nil || got != "`cf`.`company_id`" {
+		t.Fatalf("path: got %q err=%v", got, err)
+	}
+	if _, err := quoteMySQLIdentPath("cf.company_id;--"); err == nil {
+		t.Fatal("expected reject")
+	}
+}
+
+func TestQuotePGIdent(t *testing.T) {
+	got, err := quotePGIdent("companies")
+	if err != nil || got != `"companies"` {
+		t.Fatalf("got %q err=%v", got, err)
+	}
+	if _, err := quotePGIdent(`companies" OR 1=1`); err == nil {
+		t.Fatal("expected reject")
+	}
+}
+
+func TestMustQuoteMySQLIdent(t *testing.T) {
+	if got := mustQuoteMySQLIdent("key"); got != "`key`" {
+		t.Fatalf("got %q", got)
+	}
+}