fix(builder): escape/allowlist all attribute-value sinks incl. numeric/enum props (XSS)

An adversarial pass found 5 Critical XSS sinks where props declared number/enum
in TypeScript were interpolated raw into exported HTML attribute values,
trusting the type — but nothing enforces it at runtime (AI update_props only
validates node_id; deserialized saved state is untyped JSON). Fixed all 5
(NumberCounter data-target, StarRating aria-label, FormContainer method,
ContactForm/InputField input type) plus 6 sibling sinks found by an exhaustive
audit of every attribute-value interpolation across src/components: a
JS-source injection into ContentSlider's inline setInterval script, a
prototype-pollution-adjacent allowlist gap in Section's divider-shape lookup,
TextareaField rows, Testimonials rating aria-label, HeroSimple textAlign, and
MapEmbed zoom. Adds shared sanitizeFormMethod/sanitizeInputType allowlist
helpers to utils/escape.ts alongside the existing escapeAttr/safeUrl/cssValue
primitives. Every fix is TDD'd: a malicious-value test reproduces the raw
injection against the pre-fix code, then passes after the fix.

502 tests green (npx vitest run), tsc + vite build green (npm run build).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

craft/src/utils/escape.ts

@@ -154,3 +154,32 @@ export function scopeId(nodeId: string | undefined, fallbackSeed: string, prefix
   const slug = (nodeId || '').toString().toLowerCase().replace(/[^a-z0-9]+/g, '');
   return `${prefix}_${slug || stableHash(fallbackSeed)}`;
 }
+
+// Shared enum allowlists for `toHtml` attribute sinks fed by props that are
+// declared as a TS union (e.g. `method?: 'GET' | 'POST'`) but are NOT
+// type-checked at runtime -- they arrive raw via the AI `update_props` path
+// (only `node_id` is validated there) or a deserialized saved-state blob.
+// Allowlisting -- rather than escaping -- is correct here because the only
+// legitimate values are the fixed set below; anything else is either an
+// honest mistake or an attribute-breakout attempt, and both collapse safely
+// to the same known-good default.
+
+const ALLOWED_FORM_METHODS = ['GET', 'POST'] as const;
+
+/** Allowlists a `<form method>` value, case-insensitively, falling back to 'POST'. */
+export function sanitizeFormMethod(m: unknown): 'GET' | 'POST' {
+  const upper = (typeof m === 'string' ? m : '').trim().toUpperCase();
+  return (ALLOWED_FORM_METHODS as readonly string[]).includes(upper) ? (upper as 'GET' | 'POST') : 'POST';
+}
+
+const ALLOWED_INPUT_TYPES = [
+  'text', 'email', 'tel', 'number', 'password', 'url', 'search',
+  'date', 'time', 'datetime-local', 'month', 'week',
+  'checkbox', 'radio', 'hidden', 'color', 'range', 'file',
+] as const;
+
+/** Allowlists an `<input type>` value, falling back to 'text'. */
+export function sanitizeInputType(t: unknown): string {
+  const value = typeof t === 'string' ? t : '';
+  return (ALLOWED_INPUT_TYPES as readonly string[]).includes(value) ? value : 'text';
+}