dream: HTML escaping (dream-escape) + fix XSS hole in todo demo + 11 tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/dream/demos/todo.sx

@@ -1,6 +1,7 @@
 ;; lib/dream/demos/todo.sx — CRUD todo list with forms + CSRF (todo.ml).
 ;; An in-memory store holds items; add/toggle/delete go through POST forms guarded
-;; by the CSRF middleware. Wires session -> csrf -> router.
+;; by the CSRF middleware. User text is HTML-escaped on render (dream-escape).
+;; Wires session -> csrf -> router.
 
 (define
   dream-todo-store
@@ -19,7 +20,7 @@
             acc
             "<li>"
             (if (get it :done) "[x] " "[ ] ")
-            (get it :text)
+            (dream-escape (get it :text))
             "</li>"))
         ""
         ((get store :all)))