Render Sentence

Sentence-template render request.

Security (R4 P0-1, 2026-05-17): both brand and sentence_template are user-controlled. The validator below ensures the template only contains the literal {brand} placeholder — no nested braces, no attribute access forms like {brand.__class__}. This defangs the Python str.format SSTI primitive (information disclosure via interpreter-graph walk). The accent service uses str.replace rather than str.format as a second layer of defense.