refactor: move o SQL restante das vistas de multi-ginásio (fecha 6.3)

Os últimos 3 pontos de SQL direto em vistas, que tinham entrado depois
da auditoria original (trabalho de multi-ginásio): gyms/create.php e
gyms/edit.php partilhavam a mesma query da lista de galerias — agora
db_galleries_options() em functions_galerias.php (e simplificada: o
_gyms_has_col() defensivo já não é preciso, galleries.deleted_at
existe desde a migração de 25/09). reviews/index.php gravava
google_place_id à mão — agora db_gym_set_place_id(), separado do
db_gyms_update() geral para não auditar/validar o resto do registo
por uma só coluna.

Zero vistas com SQL direto agora (grep confirma).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

config/functions_galerias.php

@@ -8,6 +8,12 @@ function db_gallery_list(PDO $pdo): array {
     return $pdo->query("SELECT * FROM galleries WHERE deleted_at IS NULL ORDER BY name")->fetchAll(PDO::FETCH_ASSOC);
 }
 
+// id => name pairs for a <select> (gyms create/edit "gallery" picker).
+function db_galleries_options(PDO $pdo): array {
+    return $pdo->query("SELECT id, name FROM galleries WHERE deleted_at IS NULL ORDER BY id")
+               ->fetchAll(PDO::FETCH_KEY_PAIR);
+}
+
 function db_gallery_get(PDO $pdo, int $id): ?array {
     $stmt = $pdo->prepare("SELECT * FROM galleries WHERE id = ? LIMIT 1");
     $stmt->execute([$id]);

config/functions_gyms.php

@@ -222,6 +222,14 @@ function db_gyms_update(PDO $pdo, int $id, array $d): bool {
     return $__r;
 }
 
+// Single-field setter for views/admin/reviews/index.php — that page only
+// touches google_place_id, not the rest of the gym record db_gyms_update()
+// would validate/audit.
+function db_gym_set_place_id(PDO $pdo, int $id, string $placeId): void {
+    $pdo->prepare("UPDATE gyms SET google_place_id = ?, updated_at = NOW() WHERE id = ?")
+        ->execute([$placeId, $id]);
+}
+
 // Soft delete. The default gym can't go (the root URL needs somewhere to land).
 function db_gyms_delete(PDO $pdo, int $id): bool {
     $st = $pdo->prepare("UPDATE gyms SET deleted_at = NOW(), is_published = 0

views/admin/gyms/create.php

@@ -5,8 +5,7 @@ $user = require_admin();
 
 $errors    = [];
 $data      = gym_defaults();
-$galleries = $pdo->query("SELECT id, name FROM galleries" . (_gyms_has_col($pdo, 'galleries', 'deleted_at') ? " WHERE deleted_at IS NULL" : "") . " ORDER BY id")
+$galleries = db_galleries_options($pdo);
-                 ->fetchAll(PDO::FETCH_KEY_PAIR);
 $sources   = db_gyms_list($pdo);
 $copy_from = (int) ($_POST['copy_from'] ?? 0);
 $copy_what = (array) ($_POST['copy'] ?? array_keys(gyms_copy_options()));

views/admin/gyms/edit.php

@@ -9,8 +9,7 @@ if (!$item || $item['deleted_at'] !== null) { header('Location: index.php'); exi
 
 $errors    = [];
 $data      = $item;
-$galleries = $pdo->query("SELECT id, name FROM galleries" . (_gyms_has_col($pdo, 'galleries', 'deleted_at') ? " WHERE deleted_at IS NULL" : "") . " ORDER BY id")
+$galleries = db_galleries_options($pdo);
-                 ->fetchAll(PDO::FETCH_KEY_PAIR);
 
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     csrf_check();

views/admin/reviews/index.php

@@ -21,8 +21,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         } elseif ($key !== '') {
             db_update_setting($pdo, 'google_places_api_key', secret_encrypt($key), $uid);
         }
-        $pdo->prepare("UPDATE gyms SET google_place_id = ?, updated_at = NOW() WHERE id = ?")
+        db_gym_set_place_id($pdo, (int) $rgym['id'], mb_substr(trim((string) ($_POST['google_place_id'] ?? '')), 0, 120));
-            ->execute([mb_substr(trim((string) ($_POST['google_place_id'] ?? '')), 0, 120), (int) $rgym['id']]);
         db_update_setting($pdo, 'google_reviews_min_rating', (string) max(1, min(5, (int) ($_POST['min_rating'] ?? 4))), $uid);
         db_update_setting($pdo, 'google_reviews_max', (string) max(1, min(5, (int) ($_POST['max'] ?? 3))), $uid);
         db_update_setting($pdo, 'google_reviews_cache_hours', (string) max(1, (int) ($_POST['cache_hours'] ?? 24)), $uid);