fix(task_execute): lotto/seriale in |tojson invece di letterale JS (#32)

lotNumber/serialNumber erano '{{ lot_number or '' }}': autoescape HTML dentro
uno <script>, non escaping JS/JSON. '&' diventava '&amp;' e finiva salvato nel
DB a ogni misura e a production/start; un lotto con backslash rompeva la
sintassi JS della pagina. |tojson produce un letterale JSON valido sia come JS
che come HTML, come già fa refuseWhileBlocked() più sotto nello stesso file.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/frontend/flask_app/templates/measure/task_execute.html

@@ -926,8 +926,8 @@ function taskExecute() {
     // ---- Data from server ----
     task: window.__taskData,
     subtasks: window.__taskSubtasks,
-    lotNumber: '{{ lot_number or '' }}',
-    serialNumber: '{{ serial_number or '' }}',
+    lotNumber: {{ (lot_number or '')|tojson }},
+    serialNumber: {{ (serial_number or '')|tojson }},
     // ---- Measurement state ----
     currentIndex: 0,
     measurements: [],   // [{subtask_id, value, pass_fail, deviation}, ...]