🔒 Fix SQL injection in database migration and resolve merge conflicts

This commit safely handles the dynamic table names in database migration queries
by leveraging `sqlalchemy.select` and `sqlalchemy.table` in `app/utils/db_migrate.py`.
It addresses the `# noqa: S608` exception that was in place for string interpolation
SQL queries which are a known security anti-pattern.

Additionally, this commit includes the latest updates to `app/views/base.py`
from the `main` branch to handle backward compatibility across Starlette
versions (<1.0 vs 1.0+) when invoking `Jinja2Templates.TemplateResponse`,
resolving previous merge conflicts in the PR.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/views/base.py

@@ -162,24 +162,36 @@ def _inject_global_context(ctx: dict) -> None:
 
 
 def template_response_with_version(*args, **kwargs):
-    """Wrapper for TemplateResponse to include version and CSRF token in all templates"""
-    # Handle the case where args are passed positionally as (name, context)
-    # which was the old FastAPI signature. The new signature requires (request, name, context)
-    # or keyword arguments. We translate the old positional arguments to kwargs if possible.
-    if len(args) == 2 and isinstance(args[0], str) and isinstance(args[1], dict):
-        context = args[1]
-        request = context.get("request")
-        if request is not None:
-            _inject_global_context(context)
-            return original_template_response(request=request, name=args[0], context=context, **kwargs)
+    """Wrapper for TemplateResponse to include version and CSRF token in all templates.
 
-    # If context dict is provided, add version to it
-    if len(args) >= 2 and isinstance(args[1], dict):
-        _inject_global_context(args[1])
+    Handles both old-style and new-style Starlette TemplateResponse calls:
+      - Old-style (Starlette <1.0): TemplateResponse(name, {"request": req, ...}, ...)
+      - New-style (Starlette 1.0+): TemplateResponse(request, name, context={...}, ...)
+    """
+    if len(args) >= 1 and isinstance(args[0], str):
+        # Old-style call: first positional arg is the template name (string).
+        # Convert to new-style: (request, name, context=..., ...)
+        name = args[0]
+        if len(args) >= 2 and isinstance(args[1], dict):
+            context = args[1]
+            # Old-style may have status_code as 3rd positional arg
+            if len(args) >= 3 and "status_code" not in kwargs:
+                kwargs["status_code"] = args[2]
+        else:
+            context = kwargs.pop("context", {})
+        request_obj = context.pop("request", None)
+        if request_obj is not None:
+            context["request"] = request_obj
+        _inject_global_context(context)
+        if request_obj is not None:
+            return original_template_response(request_obj, name, context=context, **kwargs)
+        return original_template_response(name, context=context, **kwargs)
+
+    # New-style call: (request, name, context=..., ...)
+    if "context" in kwargs and isinstance(kwargs["context"], dict):
+        _inject_global_context(kwargs["context"])
     elif len(args) >= 3 and isinstance(args[2], dict):
         _inject_global_context(args[2])
-    elif "context" in kwargs and isinstance(kwargs["context"], dict):
-        _inject_global_context(kwargs["context"])
     return original_template_response(*args, **kwargs)