Fix CSV export field escaping and injection protection

[Ridanshi]

Closes #361

Root cause

downloadData in backend/controllers/csvDownload.controller.js built each CSV row by interpolating raw field values and joining them with commas. Only the notes column had any escaping (a manual double-quote wrapper). The other seven exported fields — id, subject_name, title, due_at, status, priority, and confidence_score — were written without quoting, so:

• a comma in any value split it across extra columns,
• a newline broke the row boundary,
• values beginning with =, +, -, or @ could be executed as spreadsheet formulas.

Changes

backend/controllers/csvDownload.controller.js

Adds escapeCSVField(value), a single reusable helper that implements RFC 4180 serialization:

• null / undefined → "" (empty quoted field)
• Every value is wrapped in double quotes.
• Embedded double quotes are doubled (" → ""), satisfying RFC 4180 §2.7.
• Values whose first character is a known formula trigger (=, +, -, @, tab, carriage return) are prefixed with a tab character before quoting, preventing spreadsheet applications from interpreting the content as a formula.

downloadData now passes every field through escapeCSVField via a .map() call instead of the previous manual mix of raw values and a hand-rolled notes escaper. Row separators are changed from \n to \r\n per RFC 4180.

tests/exportCsv.test.js (new file)

26 tests using Node's built-in node:test runner (same runner used by the existing exportIcs suite) covering:

• plain values, numbers, dates
• null, undefined, empty string
• commas, newlines, CRLF inside fields
• embedded double quotes
• all formula-prefix characters (=, +, -, @, tab, carriage return)
• hyperlink formula injection example from the issue
• correct column count with comma-containing fields
• correct row count with newline-containing fields
• CRLF row separation
• regression cases for each previously unescaped field (id, subject_name, title, due_at, notes)

All 26 new tests pass. The 5 existing ICS tests are unaffected.

Verification

node --test tests/exportCsv.test.js
# pass 26  fail 0

node --test tests/exportIcs.test.js
# pass 5   fail 0