fix: 审计修复 — esc() 加单引号转义 + 移除死代码 editQuickCmd

B2: esc() 不转义 ' 可能在 onclick 中注入
B4: editQuickCmd 定义但无调用(✏按钮已移除)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

web/app/terminal.html

@@ -733,18 +733,6 @@ function addQuickCmd() {
   document.getElementById('qcName').focus();
 }
 
-function editQuickCmd(id) {
-  let userCmds = [];
-  try { userCmds = JSON.parse(localStorage.getItem(K_CMDS) || '[]'); } catch(e) {}
-  const cmd = userCmds.find(c => c.id === id);
-  if (!cmd) return;
-  document.getElementById('qcTitle').textContent = '编辑命令';
-  document.getElementById('qcName').value = cmd.name;
-  document.getElementById('qcCmd').value = cmd.cmd;
-  document.getElementById('qcEditId').value = id;
-  document.getElementById('qcModal').classList.remove('hidden');
-}
-
 function saveQuickCmd() {
   const name = document.getElementById('qcName').value.trim();
   const cmd = document.getElementById('qcCmd').value.trim();
@@ -798,7 +786,7 @@ function filterServerModal() {
 }
 
 // ── Utils ──
-function esc(s) { if (!s) return ''; const d = document.createElement('div'); d.textContent = s; return d.innerHTML.replace(/"/g,'"'); }
+function esc(s) { if (!s) return ''; const d = document.createElement('div'); d.textContent = s; return d.innerHTML.replace(/"/g,'"').replace(/'/g,'''); }
 
 // ── Init ──
 (async () => {