fix: escape JSON in <script>; popup player picks edited if available

P1: views were emitting <%- JSON.stringify(...) %> directly inside <script>
tags. A video title like "</script><script>alert(1)</script>" would break
out of the script and inject HTML. Added res.locals.jsonForScript() that
escapes <, >, &, U+2028, U+2029 before output and switched all three
templates (op/editor.ejs, op/folder.ejs, folder.ejs) to use it.

P2: The internal popup player in /folder/:name always hit
/api/video/:id/file which returned the original. Made the file endpoint
default to the edited variant when present and only fall back to original
when ?edited=0 is given. Editor page passes ?edited=0 explicitly so the
operator always re-trims from the original. Standalone /player/:id no
longer needs the ?edited=1 hint.

Verified: rendered editor HTML escapes </script> payloads to \u003c/script,
default file endpoint serves edited.mp4 while ?edited=0 serves original.mp4.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

views/op/editor.ejs

@@ -35,7 +35,7 @@
 
       <div id="videoPanel" class="videoPanel" <% if (!video) { %>hidden<% } %>>
         <video id="editVideo" controls preload="metadata"
-          <% if (video) { %>src="/api/video/<%= video.id %>/file"<% } %>></video>
+          <% if (video) { %>src="/api/video/<%= video.id %>/file?edited=0"<% } %>></video>
         <div class="trimControls">
           <label>
             <span>시작(초)</span>
@@ -55,8 +55,8 @@
 
   <script>
     window.__EDITOR__ = {
-      folder: <%- JSON.stringify(folder) %>,
-      video: <%- JSON.stringify(video) %>
+      folder: <%- jsonForScript(folder) %>,
+      video: <%- jsonForScript(video) %>
     }
   </script>
   <script src="/static/editor.js"></script>

views/op/folder.ejs

@@ -43,7 +43,7 @@
   </div>
 
   <script>
-    window.__OP__ = { folder: <%- JSON.stringify(folder) %> }
+    window.__OP__ = { folder: <%- jsonForScript(folder) %> }
   </script>
   <script src="/static/folder.js"></script>
 </body>