BUG-041: f-string in te_loader.py execute() — SQL injection risk #10

Summary

_cleanup_prior_registry_entries in api/services/te_loader.py line 99
uses an f-string inside execute(), which is prohibited by the AST security
test.

Failing test

tests/test_api.py::TableNameGuards::test_identifiers_are_never_string_formatted

Error: execute() called with an f-string at ['te_loader.py:99']

Root cause

The function was extracted from an inline block during the sync from
PostgreDataMigrationApp. The original used psycopg2.sql.Identifier; the
extraction accidentally used an f-string instead.

Fix

Replace line 99 in api/services/te_loader.py:

Before:
cur.execute(f"DROP TABLE IF EXISTS {table_name}")

After:
from psycopg2 import sql as _sql
cur.execute(
_sql.SQL("DROP TABLE IF EXISTS {}").format(
_sql.Identifier(*table_name.split("."))
if "." in table_name
else _sql.Identifier(table_name)
)
)

Files affected

• api/services/te_loader.py line 99