fix: harden the inline bootstrap and API error logging - #12

Summary

CodeQL flagged the pre-paint script in layout.tsx because JSON.stringify does not escape "<" or the Unicode line separators, so a value containing "</script>" would end the element early; the values are our own constants today, but jsLiteral in src/lib/inline-script.ts now makes that impossible by construction. serverError in src/app/api/_lib/http.ts logged the raw error, so a message carrying request text could forge extra log lines; logLine collapses it to one bounded line. ageLabel in LineDetailView.tsx loses a null guard its only caller already covers.

Changes

• src/lib/inline-script.ts: jsLiteral, JSON.stringify with "<", U+2028 and U+2029 escaped.
• src/app/layout.tsx: the bootstrap interpolates through jsLiteral.
• src/app/api/_lib/http.ts: logLine strips control characters and caps length; serverError logs message and stack through it.
• src/components/map/LineDetailView.tsx: ageLabel takes a non-null fetchedAt.
• tests/inline-script.test.ts: escaping, round trips and log-line forging.