fix(excel): neutralize formula injection in exported names (#7)

Adds sanitizeCell(): cell values starting with = + - @ or a control char are
prefixed with an apostrophe so spreadsheets render them as literal text
instead of executing them as formulas. Applied to the names column.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

js/excel.js

@@ -8,6 +8,14 @@ export function readEmployeeNames(arrayBuffer) {
     .filter(name => name.length > 0);
 }
 
+// Neutralize spreadsheet formula injection: Excel/Sheets treat a cell starting
+// with = + - @ (or certain control chars) as a formula. Prefix such values with
+// an apostrophe so they render as literal text.
+export function sanitizeCell(value) {
+  const s = String(value ?? '');
+  return /^[=+\-@\t\r]/.test(s) ? "'" + s : s;
+}
+
 // Pure helper: returns { names: [...], dates: [...] } columns for a schedule.
 // Multiple employees per date are joined alphabetically with " & ".
 export function buildScheduleColumns(assignments, employees) {
@@ -19,7 +27,7 @@ export function buildScheduleColumns(assignments, employees) {
   }
   const sortedDates = [...byDate.keys()].sort();
   const names = sortedDates.map(d =>
-    byDate.get(d).slice().sort((x, y) => x.localeCompare(y, 'de')).join(' & ')
+    sanitizeCell(byDate.get(d).slice().sort((x, y) => x.localeCompare(y, 'de')).join(' & '))
   );
   const dates = sortedDates.map(d => {
     const [y, m, day] = d.split('-');