[pandemicsyn]

Summary

• Escape stored submission, version, token, user and error text before inserting into admin HTML.
• Replace data-dependent inline handlers with delegated actions and encode IDs in API paths.
• Add regression tests for hostile stored values and action dispatch.

Validation

• npm test (57 passing)

This PR does not change submission data or deploy settings; existing stored payloads render as text after deployment.