fix(android): escape JS bridge args via JSONObject.quote (#7925)

`loadFromDb` interpolated the stored value into a single-quoted JS string
literal passed to `evaluateJavascript`. Beyond the security smell, this is
a real data-loss bug: `JSON.stringify` does not escape apostrophes, so a
backup blob containing one (e.g. a task titled "don't…") terminated the JS
literal and the load returned garbage — silently corrupting any restore
from `KeyValStore`.

Use `JSONObject.quote()` (already established in the file for
`emitForegroundServiceStartFailed`) for all three callback args, so values
containing `'`, `\`, newlines or `</script>` round-trip cleanly.

android/app/src/main/java/com/superproductivity/superproductivity/webview/JavaScriptInterface.kt

@@ -100,8 +100,18 @@ class JavaScriptInterface(
     @JavascriptInterface
     fun loadFromDb(requestId: String, key: String) {
         val r = (activity.application as App).keyValStore.get(key, "")
-        // NOTE: ' are important as otherwise the json messes up
-        callJavaScriptFunction(FN_PREFIX + "loadFromDbCallback('" + requestId + "', '" + key + "', '" + r + "')")
+        // Use JSONObject.quote() so the stored value can contain ' / \ / newlines /
+        // </script> without breaking out of the JS literal (#7925). The previous
+        // raw single-quote interpolation broke on any value with a literal '
+        // (JSON.stringify does not escape apostrophes), so an apostrophe in a
+        // backup blob silently corrupted the load. quote() produces a properly
+        // escaped double-quoted JS string.
+        callJavaScriptFunction(
+            FN_PREFIX + "loadFromDbCallback(" +
+                JSONObject.quote(requestId) + ", " +
+                JSONObject.quote(key) + ", " +
+                JSONObject.quote(r) + ")"
+        )
     }
 
     @Suppress("unused")