fix(security): prevent CSV format corruption and formula injection in export

[Vedhant26]

🔒 Fix: Prevent CSV Format Corruption and Formula Injection

Closes #969

Problem

1. Format Corruption: If a user created a task with a title containing commas (e.g. Task 1, and 2), the CSV export treated the comma as a column delimiter because the field wasn't wrapped in quotes. This shifted all subsequent columns and broke the entire spreadsheet structure.
2. Formula Injection (CSV Injection): A malicious user could create a task starting with formula characters (=, +, -, @). When opened in Excel, this would trigger macro/formula execution, leading to potential RCE or data exfiltration.

Solution

• Created a robust escapeCsvField() utility.
• Every field is now properly converted to a string and safely wrapped in double quotes "".
• Internal double quotes are properly escaped by doubling them ("").
• If a field starts with a dangerous formula character (=, +, -, @), it is automatically prefixed with a single quote ' to force spreadsheet processors to interpret the cell as raw text instead of an executable macro.