fix: escape scenario id when serialising saved page

PostTeamEditor interpolated the scenario id into a <script> block as
'localStorage.setItem("scenario:<id>", ...)', so an id containing
'</script><script>...</script>' would break out of the JS-string context
and execute in the browser. Use json_encode with JSON_HEX_TAG / HEX_AMP /
HEX_APOS / HEX_QUOT so the id is always a safe JS string literal.

Adds a PostTeamEditorTest case that submits '</script><script>alert(1)</script>'
and asserts the literal '<script>alert(1)</script>' substring is absent
from the response. Updates the existing happy-path and FullFlowTest
assertions to match the new 'scenario:"demo"' (quoted) form.

tests/Integration/FullFlowTest.php

@@ -45,7 +45,7 @@ final class FullFlowTest extends TestCase
             $teamBody = $this->runFrontController();
             self::assertSame(200, $this->lastStatus);
             self::assertStringContainsString('localStorage.setItem', $teamBody);
-            self::assertStringContainsString('scenario:demo', $teamBody);
+            self::assertStringContainsString('scenario:"demo"', $teamBody);
 
             // Step 3: POST battlefield editor.
             $_SERVER['REQUEST_METHOD'] = 'POST';