A test pins the social cards: a private repository's card is a 404 to a guest, and a title's markup is escaped in the SVG #6828

src/web/pages/og.ts draws GET /og/{repo,app,issue,pull,run,map}/:ref.svg from user text and is 452 lines with no test importing it.

Done, in test/og-cards.test.ts:

• [ ] For each kind, a public ref answers 200 image/svg+xml with the security headers of src/server.ts.
• [ ] An issue and a pull in a private repository answer 404 to a guest and to a stranger, the same body as a missing ref.
• [ ] An issue titled <script>alert(1)</script> & "q" appears escaped in the SVG and no <script appears in it.

Files: test/og-cards.test.ts; src/web/pages/og.ts only if a case is red. Suggested: scout.