v3.10.0 review fixes: repair /api/ram-install-app, escape quotes in esc

- /api/ram-install-app referenced undefined spi1/tar (the resolution block
  was only added to /api/ram-install and /api/cap-compat), so every request
  answered 500.  The same preset/MSL resolution is now in place, with
  regression tests for both modes (install / make selectable) and for the
  no-MSL refusal before any card I/O.
- esc() now escapes " and ' too: the TAR editor renders free-text
  descriptions (and other values) into attribute contexts, so a crafted
  preset import could inject attributes.  Three tests asserting the old
  unescaped output updated; a dedicated esc test added.
- _spi1_for_tar names the no-TAR case in its hint (a pre-built packet
  without tar/spi1 used to report "TAR ?").
- preset free TAR rows no longer store an empty "role" key (the documented
  shape); a non-list `tars` in an update is refused (400) instead of being
  silently ignored.

Live: the no-MSL request answers 400 with the hint; a make_selectable with
a bogus AID runs the format probe and the INSTALL (derived SPI1 16 from the
preset MSL), the card answers remote SW 6A88 and the counter advances - no
500.  Suites: 658 Python + 775 frontend.

No version bump: completes the unreleased v3.10.0 (6360dc5 was never
pushed).  sw cache simple-v359.

pysim_simple_server/presets.py

@@ -336,7 +336,8 @@ class PresetStore:
                 continue
             if not (e['tar'] or e['msl'] or e['desc']):
                 continue        # a blank editor row
-            out.append(e)
+            # free entries carry no `role`: the three roles are the fixed ones
+            out.append({'tar': e['tar'], 'msl': e['msl'], 'desc': e['desc']})
         return out
 
     def _normalise_keyset(self, ks):
@@ -472,7 +473,9 @@ class PresetStore:
                     merged[k] = fields[k]
             if isinstance(fields, dict) and 'keysets' in fields:
                 merged['keysets'] = fields['keysets']
-            if isinstance(fields, dict) and isinstance(fields.get('tars'), list):
+            if isinstance(fields, dict) and 'tars' in fields:
+                if not isinstance(fields['tars'], list):
+                    raise PresetError('tars must be a list of TAR entries')
                 merged['tars'] = fields['tars']
             new = self._normalise(merged)
             new['id'] = cur['id']