fix(builder): escape/allowlist all attribute-value sinks incl. numeric/enum props (XSS)

An adversarial pass found 5 Critical XSS sinks where props declared number/enum
in TypeScript were interpolated raw into exported HTML attribute values,
trusting the type — but nothing enforces it at runtime (AI update_props only
validates node_id; deserialized saved state is untyped JSON). Fixed all 5
(NumberCounter data-target, StarRating aria-label, FormContainer method,
ContactForm/InputField input type) plus 6 sibling sinks found by an exhaustive
audit of every attribute-value interpolation across src/components: a
JS-source injection into ContentSlider's inline setInterval script, a
prototype-pollution-adjacent allowlist gap in Section's divider-shape lookup,
TextareaField rows, Testimonials rating aria-label, HeroSimple textAlign, and
MapEmbed zoom. Adds shared sanitizeFormMethod/sanitizeInputType allowlist
helpers to utils/escape.ts alongside the existing escapeAttr/safeUrl/cssValue
primitives. Every fix is TDD'd: a malicious-value test reproduces the raw
injection against the pre-fix code, then passes after the fix.

502 tests green (npx vitest run), tsc + vite build green (npm run build).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

craft/src/utils/escape.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from 'vitest';
-import { escapeHtml, escapeAttr, safeUrl, stableHash, scopeId } from './escape';
+import { escapeHtml, escapeAttr, safeUrl, stableHash, scopeId, sanitizeFormMethod, sanitizeInputType } from './escape';
 
 describe('escapeHtml', () => {
   test('escapes &, <, >, "', () => {
@@ -140,3 +140,56 @@ describe('scopeId', () => {
     expect(scopeId('node-abc', 'seed', 'tabs')).toMatch(/^tabs_/);
   });
 });
+
+describe('sanitizeFormMethod', () => {
+  test('allows GET and POST unchanged', () => {
+    expect(sanitizeFormMethod('GET')).toBe('GET');
+    expect(sanitizeFormMethod('POST')).toBe('POST');
+  });
+
+  test('is case-insensitive and normalizes to uppercase', () => {
+    expect(sanitizeFormMethod('get')).toBe('GET');
+    expect(sanitizeFormMethod('post')).toBe('POST');
+    expect(sanitizeFormMethod('PoSt')).toBe('POST');
+  });
+
+  test('falls back to POST for anything not in the allowlist', () => {
+    expect(sanitizeFormMethod('DELETE')).toBe('POST');
+    expect(sanitizeFormMethod('')).toBe('POST');
+    expect(sanitizeFormMethod(undefined as any)).toBe('POST');
+  });
+
+  test('neutralizes an attribute-breakout injection instead of passing it through', () => {
+    const malicious = 'POST"><script>alert(1)</script>';
+    expect(sanitizeFormMethod(malicious)).toBe('POST');
+  });
+
+  test('coerces non-string input safely', () => {
+    expect(sanitizeFormMethod(123 as any)).toBe('POST');
+    expect(sanitizeFormMethod(null as any)).toBe('POST');
+  });
+});
+
+describe('sanitizeInputType', () => {
+  test('allows known-safe input types unchanged', () => {
+    ['text', 'email', 'tel', 'number', 'password', 'url', 'search', 'date', 'checkbox', 'radio', 'hidden'].forEach((t) => {
+      expect(sanitizeInputType(t)).toBe(t);
+    });
+  });
+
+  test('falls back to text for anything not in the allowlist', () => {
+    expect(sanitizeInputType('bogus')).toBe('text');
+    expect(sanitizeInputType('')).toBe('text');
+    expect(sanitizeInputType(undefined as any)).toBe('text');
+  });
+
+  test('neutralizes an attribute-breakout injection instead of passing it through', () => {
+    const malicious = 'text"><img src=x onerror=alert(1)>';
+    expect(sanitizeInputType(malicious)).toBe('text');
+  });
+
+  test('coerces non-string input safely', () => {
+    expect(sanitizeInputType(123 as any)).toBe('text');
+    expect(sanitizeInputType(null as any)).toBe('text');
+  });
+});