v3.10.0 review fixes: repair /api/ram-install-app, escape quotes in esc

- /api/ram-install-app referenced undefined spi1/tar (the resolution block
  was only added to /api/ram-install and /api/cap-compat), so every request
  answered 500.  The same preset/MSL resolution is now in place, with
  regression tests for both modes (install / make selectable) and for the
  no-MSL refusal before any card I/O.
- esc() now escapes " and ' too: the TAR editor renders free-text
  descriptions (and other values) into attribute contexts, so a crafted
  preset import could inject attributes.  Three tests asserting the old
  unescaped output updated; a dedicated esc test added.
- _spi1_for_tar names the no-TAR case in its hint (a pre-built packet
  without tar/spi1 used to report "TAR ?").
- preset free TAR rows no longer store an empty "role" key (the documented
  shape); a non-list `tars` in an update is refused (400) instead of being
  silently ignored.

Live: the no-MSL request answers 400 with the hint; a make_selectable with
a bogus AID runs the format probe and the INSTALL (derived SPI1 16 from the
preset MSL), the card answers remote SW 6A88 and the counter advances - no
500.  Suites: 658 Python + 775 frontend.

No version bump: completes the unreleased v3.10.0 (6360dc5 was never
pushed).  sw cache simple-v359.

docs/api.md

@@ -257,7 +257,8 @@ import also accepts presets exported by the older localStorage-based builds.
   hex are normalised to one form) is refused with
   `400 {"error": "card with this ICCID already exists: …"}`.
 - `POST /api/presets/update` — `{"id": "…", "fields": {…}}` (partial update;
-  a plain `{id, name, …}` body works too, and `keysets` replaces the list).
+  a plain `{id, name, …}` body works too, `keysets` replaces the list and
+  `tars` the TAR table — a non-list `tars` value is refused).
   A counter is written as given — this is the deliberate human edit; unknown
   ids answer `404`.
 - `POST /api/presets/delete` — `{"id": "…"}` → `{"ok": true, "removed": true}`.