fix(admin): escape user-controlled values in admin templates (XSS)

[mmcintosh]

Summary

Escapes user-controlled values that were interpolated raw into admin-side HTML templates, closing a set of stored/reflected XSS sinks. The highest-value one is stored XSS via the content list: a content author controls a document's title/slug, which are rendered unescaped into the admin content list that a higher-privileged admin views — so an author could run script in an admin's session.

All escaping uses escapeHtml from utils/sanitize (R8).

Sinks fixed

• Content list (admin-content-list.template.ts) — title, slug (stored; author → admin).
• Content form (admin-content-form.template.ts) — the reflected ?ref= referrer param, in both the back-link href and the hidden referrer_params input.
• Users list (admin-users-list.template.ts) — avatar src (attribute) + first/last name (alt).
• Media grid + file details (media-grid.template.ts, media-file-details.template.ts) — original_name/filename, alt, caption, folder, tags.
• Media library (admin-media-library.template.ts) — folder sidebar: encodeURIComponent in the href, escapeHtml in the body.
• Settings (admin-settings.template.ts) — siteName, adminEmail, siteDescription.
• Plugin settings (admin-plugin-settings.template.ts) — generic string setting value (via the file's existing escapeHtmlAttr; the number branch is left as-is — numbers are safe).

Tests

• admin-templates-xss.test.ts (unit) — renders content-list, users-list, media-file-details, and content-form with element-text and attribute-breakout payloads (<script>…</script>, "><script>…) and asserts the raw payload is absent and the escaped form present. Verified non-vacuous: reverting the content-list escape makes the matching test fail, then restored. Full core suite green; the payload-free "safe value renders unchanged" case guards against over-escaping.
• tests/e2e/111-admin-template-xss.spec.ts (@content @smoke) — drives the reflected ?ref= sink on an existing content's edit page with an attribute-breakout payload (chosen over a stored-content path because it is deterministic — the payload comes straight from the URL, not from flaky content-create + list pagination on the shared preview). Asserts it never executes (a window flag stays unset, no dialog fires, no live element is injected) and is HTML-escaped in the served markup.

Deferred to a follow-up PR (called out, not fixed here)

• JS-string onclick="…('${x}')" sinks — these need a new escapeJsAttr helper that does not yet exist in the codebase (grep-confirmed). Notable instances: media copyToClipboard('${file.public_url}') and removeMediaFromMultiple('${fieldId}','${url}') (dynamic-field.template.ts). Escaping for HTML context (this PR) does not make a value safe inside a JS string literal, so these are intentionally left for a dedicated change with the right helper + tests.
• Content-Security-Policy — middleware/security-headers.ts sets no CSP; a report-only-then-enforce CSP would be defense-in-depth over all of the above.

Draft pending maintainer review of the disclosure/coordination approach (part of the security-hardening batch). Do not merge without sign-off.

CI note

Unit tests + type-check pass. The E2E-against-preview job is red from pre-existing failures unrelated to this change — all in @auth/session/RBAC specs (02c-otp-login, 02d-magic-link-auth, 38/68/80-user-profile*, 85-admin-panel-roles, 02-authentication, 67-rbac). This is a templates-only diff; it touches no auth, route, or middleware code. The consistently-failing set is better-auth (OTP / magic-link), matching the known better-auth version drift; the rest shift run-to-run (shared-preview flakiness). Evidence: across two pushes here (a test-only change to 111-*.spec.ts) the @auth failures were invariant — only this PR's own spec dropped out once fixed. tests/e2e/111-admin-template-xss.spec.ts passes.