Ban SafeText-as-child: only Safe nodes render unescaped

Tightens the child model so the type is honest end to end. Previously a
``SafeText``/``mark_safe`` string passed as a child rendered unescaped — a
trusted-HTML-as-string backdoor that ``Child = Node | str`` couldn't express
(every ``SafeText`` is a ``str``). Now ``_child_key`` escapes *every* string
child; the only way to put trusted pre-rendered HTML into the tree is a
``Safe`` node. So a ``str`` child is always untrusted text — which is exactly
what the renderer escapes.

Converted the trusted-HTML children that relied on the old passthrough:

- ``CsrfInput`` and the Alpine selectors (``GameStatusSelector`` /
  ``SessionDeviceSelector``) now return ``Safe`` nodes instead of ``mark_safe``
  strings — they are always tree children.
- ``popover_content`` is now a ``Child`` (it is rendered as a child); the one
  HTML caller (``LinkedPurchase``) passes ``Safe(...)``.
- View-side children that were ``mark_safe`` strings → ``Safe(...)``:
  ``_played_row`` (game detail), the stat SVGs and `` `` spacer (game),
  the login table (auth), the manual session-form field/label markup
  (session), and ``_purchase_name`` (stats).
- ``SimpleTable.header_action`` typed ``Child``.

The script-tag string helpers (``ModuleScript`` / ``StaticScript`` /
``ExternalScript``) stay ``SafeText`` strings: they are only ever joined into
the ``scripts=`` string, never used as tree children.

``Children`` regains a bare ``Node`` member (a single node child is valid);
the one ``*children`` site (``Popover``) normalises via ``as_children`` first.
Tests that asserted the old SafeText-passthrough now assert the new rule
(mark_safe child escaped; ``Safe`` node passes through). Full suite green
(445; +2 new escaping tests).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_node_tree.py

@@ -29,10 +29,18 @@ class ElementRenderTest(unittest.TestCase):
             render(Element("span", children=["<b>"])), "<span>&lt;b&gt;</span>"
         )
 
-    def test_safe_children_pass_through(self):
+    def test_safe_node_child_passes_through(self):
+        self.assertEqual(
+            render(Element("span", children=[Safe("<b>x</b>")])),
+            "<span><b>x</b></span>",
+        )
+
+    def test_safetext_child_is_escaped(self):
+        # A string child is always escaped — even a mark_safe/SafeText one.
+        # Trusted markup must be a Safe node, not a safe string.
         self.assertEqual(
             render(Element("span", children=[mark_safe("<b>x</b>")])),
-            "<span><b>x</b></span>",
+            "<span>&lt;b&gt;x&lt;/b&gt;</span>",
         )
 
     def test_node_children_render_safely(self):