fix(xss): dati query in x-data passano da tojson_attr, non interpolazione JS (#10)

select_recipe.html e recipe_list.html interpolavano recipe/lot/serial/search
dentro un letterale JS con apici singoli: un valore con `'` chiudeva la
stringa e iniettava chiavi nell'oggetto x-data (CSP con unsafe-eval).
Anche recipe_list.html:222 (toLocaleDateString) aveva lo stesso schema su
current_language. Fix: |tojson_attr ovunque.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/frontend/flask_app/templates/maker/recipe_list.html

@@ -6,7 +6,7 @@
 <div class="tmf-page"
      x-data="{
        recipes: window.__recipeListData,
-       search: '{{ search or '' }}',
+       search: {{ (search or '')|tojson_attr }},
        filter: 'all',
        deleteModal: false,
        deleteTarget: null,
@@ -219,7 +219,7 @@
                       <path stroke-linecap="round" stroke-linejoin="round" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z"/>
                     </svg>
                     <span>{{ _('Aggiornata') }}</span>
-                    <span class="font-medium" x-text="new Date(recipe.current_version.created_at).toLocaleDateString('{{ current_language or 'it' }}')"></span>
+                    <span class="font-medium" x-text="new Date(recipe.current_version.created_at).toLocaleDateString({{ (current_language or 'it')|tojson_attr }})"></span>
                   </span>
                 </template>
               </div>

src/frontend/flask_app/templates/measure/select_recipe.html

@@ -6,9 +6,9 @@
 <div class="tmf-page"
      x-data="{
        recipes: window.__selectRecipeData,
-       search: '{{ auto_recipe_code }}',
-       lot_number: '{{ auto_lot }}',
-       serial_number: '{{ auto_serial }}',
+       search: {{ auto_recipe_code|tojson_attr }},
+       lot_number: {{ auto_lot|tojson_attr }},
+       serial_number: {{ auto_serial|tojson_attr }},
        barcodeModal: false,
        barcodeInput: '',
        barcodeLoading: false,