fix(security): replace string interpolation with static match in gear SQL filter

GearCategory is a Rust enum so this was not exploitable, but the
format!() pattern is a code smell. Use a match returning &'static str
literals instead for consistency with the rest of the parameterised
query codebase.

src/infrastructure/repositories/gear.rs

@@ -51,11 +51,12 @@ impl SqlGearRepository {
         })
     }
 
-    fn build_where_clause(filter: &GearFilter) -> Option<String> {
-        filter
-            .category
-            .as_ref()
-            .map(|category| format!("category = '{}'", category.as_str()))
+    fn build_where_clause(filter: &GearFilter) -> Option<&'static str> {
+        filter.category.as_ref().map(|category| match category {
+            GearCategory::Grinder => "category = 'grinder'",
+            GearCategory::Brewer => "category = 'brewer'",
+            GearCategory::FilterPaper => "category = 'filter_paper'",
+        })
     }
 }