fix(csv): neutralizza injection di formule nei campi testuali export (#22)

lot_number, serial_number (export manuale e di produzione), station.code,
recipe.code, subtask.description finivano nel CSV cosi' come arrivavano:
un lotto '=HYPERLINK(...)' apriva un link vivo in Excel/LibreOffice. Nuova
neutralise_csv_cell() in production_export_service.py, importata da
measurements.py: se il campo (spazi iniziali esclusi) comincia con =, +, -,
@, TAB o CR antepone un apice, cosi' resta testo letterale. Applicata solo
ai campi testuali, mai ai numeri.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/backend/api/routers/measurements.py

@@ -28,6 +28,7 @@ from src.backend.models.api.measurement import (
 )
 from src.backend.services import auth_service, measurement_service
 from src.backend.services.measurement_service import save_measurement
+from src.backend.services.production_export_service import neutralise_csv_cell
 
 router = APIRouter(prefix="/api/measurements", tags=["measurements"])
 
@@ -342,8 +343,8 @@ async def export_measurements_csv(
             value_str,
             m.pass_fail,
             deviation_str,
-            m.lot_number or "",
-            m.serial_number or "",
+            neutralise_csv_cell(m.lot_number or ""),
+            neutralise_csv_cell(m.serial_number or ""),
             m.input_method,
             m.measured_at.isoformat(),
             m.synced_to_csv,