feat(cv): harden multi-page builder

Wrap pathological content, paginate oversized entries, measure A4 and Letter previews correctly, unify section ordering, and gate stored-output actions on saved state.

JobTrackerApi.Tests/JobApplicationsApplicationPackageTests.cs

@@ -449,6 +449,36 @@ public sealed class JobApplicationsApplicationPackageTests
         Assert.Contains("curved", edinburgh.Html, StringComparison.OrdinalIgnoreCase);
     }
 
+    [Fact]
+    public void Template_renderer_wraps_long_content_and_escapes_sidebar_values()
+    {
+        var document = TailoredCvDraftJson.Normalize(new TailoredCvDocument
+        {
+            Headline = new string('H', 180),
+            SelectedSkills = new List<string> { $"<script>alert(1)</script>{new string('s', 400)}" },
+            Experience = new List<TailoredCvExperienceItem>
+            {
+                new()
+                {
+                    Title = new string('T', 220),
+                    Company = new string('C', 220),
+                    Start = "2020",
+                    End = "Present",
+                    Bullets = Enumerable.Range(1, 7).Select(index => index == 1 ? new string('x', 500) : $"Achievement {index}").ToList(),
+                },
+            },
+        });
+
+        var html = new CvTemplateRenderer().Render(document, "auckland", new string('N', 180), "Engineer", "Acme", null).Html;
+
+        Assert.Contains("class=\"entry entry-flow\"", html);
+        Assert.Contains("class=\"item-flow\"", html);
+        Assert.Contains("grid-template-columns:34% minmax(0,66%)", html);
+        Assert.Contains("overflow-wrap:anywhere", html);
+        Assert.Contains("&lt;script&gt;alert(1)&lt;/script&gt;", html);
+        Assert.DoesNotContain("<script>", html);
+    }
+
     private static JobApplicationsController CreateController(JobTrackerContext db, ISummarizerService summarizer, string userId, ICvTemplateRenderer? renderer = null, ICvPdfExporter? exporter = null)
     {
         var user = db.Users.AsNoTracking().FirstOrDefault(x => x.Id == userId);