v3.10.0 review fixes: repair /api/ram-install-app, escape quotes in esc

- /api/ram-install-app referenced undefined spi1/tar (the resolution block
  was only added to /api/ram-install and /api/cap-compat), so every request
  answered 500.  The same preset/MSL resolution is now in place, with
  regression tests for both modes (install / make selectable) and for the
  no-MSL refusal before any card I/O.
- esc() now escapes " and ' too: the TAR editor renders free-text
  descriptions (and other values) into attribute contexts, so a crafted
  preset import could inject attributes.  Three tests asserting the old
  unescaped output updated; a dedicated esc test added.
- _spi1_for_tar names the no-TAR case in its hint (a pre-built packet
  without tar/spi1 used to report "TAR ?").
- preset free TAR rows no longer store an empty "role" key (the documented
  shape); a non-list `tars` in an update is refused (400) instead of being
  silently ignored.

Live: the no-MSL request answers 400 with the hint; a make_selectable with
a bogus AID runs the format probe and the INSTALL (derived SPI1 16 from the
preset MSL), the card answers remote SW 6A88 and the counter advances - no
500.  Suites: 658 Python + 775 frontend.

No version bump: completes the unreleased v3.10.0 (6360dc5 was never
pushed).  sw cache simple-v359.

frontend/index.html

@@ -7662,7 +7662,10 @@ async function pysimDetectSameOrigin() {
 pysimDetectSameOrigin();
 
 function esc(str) {
-	return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+	// quotes too: the result is used inside attribute values (title, value,
+	// label) as well as in text contexts
+	return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+		.replace(/"/g, '&quot;').replace(/'/g, '&#39;');
 }
 
 async function pysimFetch(path, body) {

frontend/sw.js

@@ -1,4 +1,4 @@
-const CACHE = 'simple-v358';
+const CACHE = 'simple-v359';
 const URLS = [
   'index.html',
   'help.html',

frontend/tests/cards_iccid.test.js

@@ -58,6 +58,12 @@ function fakeAlert() {
 	return seen;
 }
 
+test('esc escapes quotes as well as the angle brackets', () => {
+	// the output is used inside attribute values (value="…", title="…",
+	// label="…") as well as in text contexts (v3.10.0 review fix)
+	assert.strictEqual(esc('a"b\'c<d>&'), 'a&quot;b&#39;c&lt;d&gt;&amp;');
+});
+
 test('cardsNormIccid accepts digits, separators and raw EF hex', () => {
 	assert.strictEqual(cardsNormIccid(DIGITS), DIGITS);
 	assert.strictEqual(cardsNormIccid(' 89 70 1190-0000 4600 098 '), DIGITS);
@@ -194,7 +200,7 @@ test('cardsRender highlights the equipped card preset', () => {
 	let rows = els['cards-tbody'].innerHTML.split('</tr>');
 	assert.ok(!/bg-emerald-50/.test(rows[0]), 'the other preset must stay plain');
 	assert.match(rows[1], /bg-emerald-50/);
-	assert.match(rows[1], /The equipped card's preset/);
+	assert.match(rows[1], /The equipped card&#39;s preset/);
 	// the same card stored as raw EF hex matches too
 	globalThis.cards[1].iccid = RAW_HEX;
 	cardsRender();

frontend/tests/ram.test.js

@@ -1443,7 +1443,7 @@ test('ramCompatRowsHtml lists AIDs with names, versions and probe state', () =>
 	assert.ok(out.includes('A0000000620101 <span class="text-gray-400 dark:text-slate-500">(javacard.framework)</span> \u2014 1.3'), out);
 	assert.ok(out.includes('1.3 \u2192 0.0 <span class="text-gray-500 dark:text-slate-400">(probe)</span>'), out);
 	assert.ok(out.includes('(appended \u2014 not in the CAP)'), out);
-	assert.ok(out.includes("(not in the CAP's import list)"), out);
+	assert.ok(out.includes('(not in the CAP&#39;s import list)'), out);
 	assert.ok(out.includes('(uicc.toolkit)'), out);
 	assert.strictEqual(ramCompatRowsHtml([]), '');
 });
@@ -1482,7 +1482,7 @@ test('ramCompatFailureHtml names the failing CAP section and the import list', (
 	};
 	const out = ramCompatFailureHtml(data, mem);
 	assert.ok(out.includes('Failed in: LOAD (1/2) \u2014 load-file bytes 0\u2013239 / 440 \u00b7 covers Header, Directory, Import \u00b7 completes Import'), out);
-	assert.ok(out.includes("The card verifies the load file's import list when the Import component is complete (JC VM spec 4.5.2)."), out);
+	assert.ok(out.includes("The card verifies the load file&#39;s import list when the Import component is complete (JC VM spec 4.5.2)."), out);
 	assert.ok(out.includes('remote SW 6985 \u2014 Conditions of use not satisfied'), out);
 	assert.ok(out.includes('Import list under test (6):'), out);
 	assert.ok(out.includes('(javacard.framework)'), out);