fix(parser): decode numeric character references instead of re-escaping them

[kklimuk]

🤖 docx-cli triage

What was wrong

Numeric character references were never decoded on parse, so any save re-escaped their &. docx replace refs.docx Alpha Beta turned <w:lvlText w:val="&#8226;"/> into w:val="•" and • – done into • – done, so Word showed the reference text instead of •. read also showed \•.

What changed

• XmlNode parse sets fast-xml-parser's htmlEntities: {}, which decodes numeric references once (• still reads as the literal text •). The empty named-entity table means HTML-only names like  , which XML doesn't define, stay literal instead of being silently rewritten. The object form is implemented but typed boolean, hence a narrow cast; a test fails if an upgrade drops it.
• Build-side escaping moved into the value processors. Attribute values now write tab/LF/CR back out as 	/
/
, so a decoded alt-text line break (descr="a
b") isn't normalized to a space on the next read. Text escaping produces the same bytes as before.
• The SVG sanitizer's isAllowedUrl now strips tab/CR/LF before checking the scheme, the way browsers do. Without this, java	script: would get past it now that attribute tabs are kept as references.
• Tests: parser unit tests (decode, decode once, HTML names stay literal, attribute whitespace), CLI invariant tests (body text and numbering.xml lvlText survive a replace), and an SVG sanitizer regression test.

Verification

• Before: read → \• \– done, and the saved XML had •. After: read → • – done, the saved files have <w:lvlText w:val="•"/> and • – done, and there's no &#.
• biome ✅ knip ✅ tsc ✅ bun run test:unit ✅ (1713 tests). The pre-commit hook passed on the latest commit.
• /simplify: flagged the attribute-whitespace round-trip, now fixed. /code-review xhigh: caught the SVG java<TAB>script: bypass that change opened, and replaced a NUL-marker escaping trick with plain value-processor escaping. Both fixed.

Decisions (settled)

• Decode numeric references only; HTML named entities stay literal (htmlEntities: {}).
• Leave the two whitespace gaps (a raw newline/tab written directly into an attribute; 
 in text). A scan of all 36 repo .docx files (493 parts) found zero instances of either. The case this PR does handle, Word's default alt text descr="…

Description automatically generated", appears 31 times.

Fixes #12

🤖 Generated with Claude Code

https://claude.ai/code/session_012GoxD36rnNfg6uArkVxtJL

---

Generated by Claude Code

[kklimuk]

🤖 docx-cli triage

Opened this for #12: numeric character references (•) now decode on read instead of being re-escaped into literal text on every save. Unit tests pass (1712) and biome/knip/tsc are clean. Two product questions are in the description.

Action needed: approve/merge — review the diff and the two decision checkboxes in the description, then merge #14.

---

Generated by Claude Code