fix(catalog): unescape formula-neutralized quotes during menu CSV import #1075

Bug Description

In main/lib/csv.ts:10, CSV formula injection neutralization prepends a single quote ' to fields starting with =, +, -, @ during export. When the exported CSV is subsequently imported via POST /api/menu-csv/import/products (main/routes/menu-csv.ts:80-140), the importer never strips the neutralizing single quote. This mutates names (e.g. +Formula Special becomes '+Formula Special) and spawns duplicate categories and add-ons on round-trip export/import cycles.

Invariant / Contract Violated

Core Invariant: Data Safety & Catalog Integrity - Exporting and re-importing catalog CSV data must preserve exact entity identities and names.

Steps to Reproduce

1. Create a product or category starting with + (e.g. +Special Curry).
2. Export products via GET /api/menu-csv/export/products.
3. Re-import the exported CSV via POST /api/menu-csv/import/products.
4. Check the stored product name in the catalog.

Expected Behavior

Product name remains +Special Curry and matches the existing record without creating duplicates.

Actual Behavior

Product name is mutated to '+Special Curry and a duplicate record is inserted.

Minimal Reproduction Code

test('reproduce CSV formula unescape omission on import', async ({ request }) => {
  const ownerToken = getE2eToken('e2e-owner', '[email protected]', 'owner');
  // Export and inspect re-import behavior
  const csvData = 'id,name,price,category\n,+Special,50,Kitchen';
  const res = await request.post('/api/menu-csv/import/products', {
    headers: { Authorization: `Bearer ${ownerToken}` },
    multipart: { file: { name: 'menu.csv', mimeType: 'text/csv', buffer: Buffer.from(csvData) } }
  });
  expect(res.ok()).toBeTruthy();
});

Sanitized Logs / Error Output

Database check:
SELECT name FROM products WHERE name LIKE '%Special%';
Result: "'+Special" (unstripped quote from CSV export neutralization)

Environment

• Version/Commit: 3.12.88-beta (8277362)
• Actor Role: owner, manager
• Viewport: 1920x1080

Scope Boundary & Non-Goals

• In Scope: Strip leading formula-neutralization single quotes during CSV import in main/routes/menu-csv.ts.
• Non-Goals: Do not remove CSV injection protection from main/lib/csv.ts on export.

Acceptance Criteria:

• The minimal reproduction test passes.
• No regression in adjacent tests (npm run test:e2e:browser).
• Follows existing backend/frontend architecture invariants.

Suspected Root Cause

main/routes/menu-csv.ts#L80-L140 (Omission of quote-stripping counterpart to main/lib/csv.ts:10) (Analysis only; no fix applied in this audit)