v3.10.0 review fixes: repair /api/ram-install-app, escape quotes in esc

- /api/ram-install-app referenced undefined spi1/tar (the resolution block
  was only added to /api/ram-install and /api/cap-compat), so every request
  answered 500.  The same preset/MSL resolution is now in place, with
  regression tests for both modes (install / make selectable) and for the
  no-MSL refusal before any card I/O.
- esc() now escapes " and ' too: the TAR editor renders free-text
  descriptions (and other values) into attribute contexts, so a crafted
  preset import could inject attributes.  Three tests asserting the old
  unescaped output updated; a dedicated esc test added.
- _spi1_for_tar names the no-TAR case in its hint (a pre-built packet
  without tar/spi1 used to report "TAR ?").
- preset free TAR rows no longer store an empty "role" key (the documented
  shape); a non-list `tars` in an update is refused (400) instead of being
  silently ignored.

Live: the no-MSL request answers 400 with the hint; a make_selectable with
a bogus AID runs the format probe and the INSTALL (derived SPI1 16 from the
preset MSL), the card answers remote SW 6A88 and the counter advances - no
500.  Suites: 658 Python + 775 frontend.

No version bump: completes the unreleased v3.10.0 (6360dc5 was never
pushed).  sw cache simple-v359.

pysim_simple_server/presets.py

@@ -336,7 +336,8 @@ class PresetStore:
                 continue
             if not (e['tar'] or e['msl'] or e['desc']):
                 continue        # a blank editor row
-            out.append(e)
+            # free entries carry no `role`: the three roles are the fixed ones
+            out.append({'tar': e['tar'], 'msl': e['msl'], 'desc': e['desc']})
         return out
 
     def _normalise_keyset(self, ks):
@@ -472,7 +473,9 @@ class PresetStore:
                     merged[k] = fields[k]
             if isinstance(fields, dict) and 'keysets' in fields:
                 merged['keysets'] = fields['keysets']
-            if isinstance(fields, dict) and isinstance(fields.get('tars'), list):
+            if isinstance(fields, dict) and 'tars' in fields:
+                if not isinstance(fields['tars'], list):
+                    raise PresetError('tars must be a list of TAR entries')
                 merged['tars'] = fields['tars']
             new = self._normalise(merged)
             new['id'] = cur['id']

pysim_simple_server/server.py

@@ -1538,7 +1538,8 @@ def _spi1_for_tar(preset, tar_hex, explicit='', prefer_msl=False):
     card or send more security than the application expects.
     Returns ``(spi1, warning)``."""
     explicit = str(explicit or '').strip().upper()
-    msl = presets.tar_msl(preset, tar_hex)
+    tar = str(tar_hex or '').strip().upper()
+    msl = presets.tar_msl(preset, tar)
     if prefer_msl and msl:
         return msl, ''
     if explicit:
@@ -1546,12 +1547,15 @@ def _spi1_for_tar(preset, tar_hex, explicit='', prefer_msl=False):
         if msl and _hex_lt(explicit, msl):
             warning = ('SPI1 %s is below the MSL %s of TAR %s - the card may '
                        'answer 0A (insufficient security level)'
-                       % (explicit, msl, tar_hex))
+                       % (explicit, msl, tar))
         return explicit, warning
     if msl:
         return msl, ''
+    if not tar:
+        raise ValueError('no TAR for the packet and no spi1 given - pass the '
+                         'TAR (add its MSL to the card preset) or spi1')
     raise ValueError('no MSL for TAR %s in the card preset - set it in the '
-                     'Cards tab or pass spi1' % (tar_hex or '?'))
+                     'Cards tab or pass spi1' % tar)
 
 
 # RAM command formats (TS 102 226 5.2.1): the bare C-APDU (compact) or the
@@ -7696,6 +7700,20 @@ class PysimHandler(BaseHTTPRequestHandler):
                         privileges=privileges, install_params=install_params_hex,
                         stk_params=stk_params_hex, make_selectable=make_selectable)
                     step_name = 'INSTALL [for install]'
+                # SCP80 params: the SPI1 comes from the MSL of the packet's
+                # TAR (the operation uses the preset's table); a caller-supplied
+                # value is only the fallback for a TAR the preset does not carry.
+                preset = _preset_by_id(self.server, body.get('preset_id'))
+                tar = str(body.get('tar') or presets.role_tar(preset, 'isd')
+                          or '000000').strip().upper()
+                try:
+                    spi1, _ = _spi1_for_tar(preset, tar, body.get('spi1'),
+                                            prefer_msl=True)
+                except ValueError as e:
+                    err = {'success': False, 'error': str(e)}
+                    self._send_json(err, 400)
+                    self._log_resp(err)
+                    return
                 sp_state = {
                     'spi1': spi1, 'spi2': body.get('spi2', '01'),
                     'kic': body.get('kic', '25'), 'kid': body.get('kid', '25'),