dream: HTML escaping (dream-escape) + fix XSS hole in todo demo + 11 tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/dream-on-sx.md

@@ -136,6 +136,11 @@ with extensions + hardening below.
   401 + `WWW-Authenticate: Basic realm=…`, attaches `:dream-user` on success;
   `dream-basic-credentials` / `dream-authorization` accessors. `dream-require-bearer
   check` → attaches `:dream-principal` or 401; `dream-bearer-token` accessor.
+- **2026-06-07 — Ext: HTML escaping** (`lib/dream/html.sx`, 11 tests, 401 total).
+  `dream-escape` (&/</>/"/' entities, ampersand first to avoid double-escape),
+  `dream-attr`, `dream-escape-join`. Fixed a real **XSS hole** in the todo demo, which
+  interpolated user text into `<li>` unescaped — now `(dream-escape (get it :text))`;
+  regression test asserts `<script>` renders as `&lt;script&gt;`. 16 suites, 401/401.
 
 ## Extensions (post-roadmap)
 
@@ -151,6 +156,7 @@ The five-types core is complete; these harden it toward a production HTTP front
 - [x] **Query/header convenience** (`dream-queries`, `*-or` defaults, `dream-accepts?`).
 - [x] **`api.sx` facade + README** — `dream-make-app` / `dream-serve` + `README.md`.
 - [x] **Auth** — base64 (pure SX), HTTP Basic auth + Bearer-token middleware.
+- [x] **HTML escaping** (`dream-escape`/`dream-attr`) — fixed an XSS hole in the todo demo.
 
 ## Stdlib additions Dream will need