Range acceptance - could defiantly be a business rule. Cross-field consistency - Could also be a business rule.
I implement these rules both sides. Ideally i don't want an invalid command sent off in the first place. I also don't want badly implemented UI corrupting my business data.
This way i can provide instant feedback to the user, and also protect the data in case the UI is badly implemented.
The main point of these architectures is that you can use them from many user interfaces.
Adhering to dry in all cases, is not always the best solution. As the software community has discovered over the past years. Especially in relation to microservices.
In my software there's a bit of a disconnect between the application and interactors. As there is a message queue between them.
Business rules does not mean what the business (bosses) dictates that the app should have.
Business rules the rules for the business domain.
Whether you should escape sql (or even use sql) is a technical/application concern, not a business rule.
A business rule would be something like "customers must get 10% discount if they bought more than 100 units" or "no employee should be allowed to have a salary bigger than their manager", etc.