fix: html-escape recipe/ingredient names in email templates (#P5-a, #P5-b)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

backend/tests/test_orchestrator.py

@@ -316,6 +316,29 @@ def test_step_email_stale_banner(db, weekly_run_generated, meal_plan, pending_it
     assert "prices" in sent[0]["html"].lower() or "stale" in sent[0]["html"].lower()
 
 
+def test_step_email_escapes_recipe_name(
+    db, weekly_run_generated, meal_plan, pending_item, member, monkeypatch
+):
+    pending_item.recipe.name = "<script>alert('xss')</script>"
+    db.flush()
+
+    sent = []
+
+    class FakeBackend:
+        def send(self, **kwargs):
+            sent.append(kwargs)
+
+    monkeypatch.setattr(
+        "app.services.orchestrator.steps.get_email_backend",
+        lambda: FakeBackend(),
+    )
+    from app.services.orchestrator.steps import step_email
+    step_email(weekly_run_generated, db)
+    assert len(sent) == 1
+    assert "<script>" not in sent[0]["html"]
+    assert "&lt;script&gt;" in sent[0]["html"]
+
+
 # ── step_reminder ──────────────────────────────────────────────────────────