Add HTML template codegen and runtime for C backend

C codegen (codegen.el):
- cg_html_template: emits a GCC/Clang statement-expression that
  builds the HTML string via el_str_concat chains
- cg_html_element_str / cg_html_parts / cg_html_attrs_str: recursive
  element and attribute emitters
- cg_html_each: {#each} compiles to a C for-loop with el_list_get
- __html_counter state tracks unique accumulator variable names
- Handles both 'static' (raw string) and 'dynamic' (expr node) attrs
  matching the parser's attribute kind convention

Runtime (el_runtime.c / el_runtime.h):
- html_escape(s): escapes & < > " ' for safe interpolation
- html_raw(s): identity function for raw() bypass
- Both use the existing html_buf_t infrastructure from el_html_sanitize

el-compiler/runtime/el_runtime.c

@@ -2602,6 +2602,45 @@ el_val_t el_html_sanitize(el_val_t input_v, el_val_t allowlist_v) {
     return el_wrap_str(result);
 }
 
+/* ── html_escape / html_raw ──────────────────────────────────────────────── */
+/*
+ * html_escape(s) — escape a user-supplied string for safe inline interpolation
+ * in HTML text content or attribute values.  Escapes: & < > " '
+ *
+ * html_raw(s) — identity function; used by the `raw()` escape hatch in El HTML
+ * templates to explicitly opt out of escaping.
+ */
+
+el_val_t html_escape(el_val_t sv) {
+    const char* s = EL_CSTR(sv);
+    if (!s) return EL_STR("");
+    html_buf_t out;
+    html_buf_init(&out);
+    for (const char* p = s; *p; p++) {
+        unsigned char c = (unsigned char)*p;
+        switch (c) {
+            case '&':  html_buf_puts(&out, "&amp;");  break;
+            case '<':  html_buf_puts(&out, "&lt;");   break;
+            case '>':  html_buf_puts(&out, "&gt;");   break;
+            case '"':  html_buf_puts(&out, "&quot;"); break;
+            case '\'': html_buf_puts(&out, "&#39;");  break;
+            default:   html_buf_putc(&out, (char)c);  break;
+        }
+    }
+    char* result = el_strbuf(out.len);
+    memcpy(result, out.data, out.len);
+    result[out.len] = '\0';
+    html_buf_free(&out);
+    return el_wrap_str(result);
+}
+
+el_val_t html_raw(el_val_t sv) {
+    /* Identity — returns the value unchanged.  The name exists so generated
+     * code can call html_raw(expr) instead of expr directly, making it clear
+     * at the call site that escaping is intentionally bypassed. */
+    return sv;
+}
+
 /* ── JSON ────────────────────────────────────────────────────────────────── */
 
 /* True iff the segment is non-empty and every byte is an ASCII digit. We treat

el-compiler/runtime/el_runtime.h

@@ -214,6 +214,13 @@ el_val_t  url_decode(el_val_t s);   /* '+' → space, %XX → byte  */
  * where each value is the array of attribute names allowed for that tag. */
 el_val_t  el_html_sanitize(el_val_t input_html, el_val_t allowlist_json);
 
+/* ── HTML template helpers ───────────────────────────────────────────────────
+ * Used by compiled El HTML template expressions.
+ * html_escape(s) — escape & < > " ' for safe inline interpolation.
+ * html_raw(s)    — identity; explicit opt-out from escaping (`raw()` form). */
+el_val_t  html_escape(el_val_t s);
+el_val_t  html_raw(el_val_t s);
+
 /* ── Filesystem ──────────────────────────────────────────────────────────── */
 
 el_val_t  fs_read(el_val_t path);