security: escape stored WMI output, bind remaining SQL, scope the augmented role

[somethingwithproof]

All post-auth (WMI Management realm). Output-escaping model: values stay raw at rest, escaped on render, so WQL strings are unchanged.

Stored/reflected XSS

• wmi_queries.php: name/namespace/query/primary_key in the list, and the edit header, now escape on output (html_escape / __esc).
• wmi_accounts.php: username in the list, and the edit header, now escape on output.
• wmi_tools.php: the reflected device name and the WMI-returned column names/values in the query tool now escape on output (second-order XSS from a queried host).

SQL

• Bound the remaining interpolated queries as prepared statements in functions.php, poller_wmi.php, and script/wmi-script.php. The functions.php sinks are unreachable today; this is defense in depth.

Authorization

• Dropped wmi_accounts.php (credential store) and wmi_tools.php (live query tool, which reaches Linux_WMI::exec) from the Template Editor auth augment. Template Editors keep wmi_queries.php for query definition; credential management and live exec stay behind the WMI Management realm.

No schema, storage-format, or behavioral change. Complements #13 (hostname/namespace escaping in exec).