hardening: prevent CSV formula injection and malformed CSV output in exports

[somethingwithproof]

Summary

CSV export writes attacker-controlled fields directly into quoted CSV without CSV-safe escaping or formula neutralization.

Evidence

functions.php export blocks around:

• 800-807
• 827-836

Values are concatenated directly, including host/message/log text.

Risk

• Spreadsheet formula execution when cells begin with =, +, -, @
• Broken CSV format for embedded quotes/newlines

Expected fix

• Use fputcsv() (or equivalent robust escaping)
• Prefix dangerous leading formula characters with '
• Preserve existing export columns/format semantics

[somethingwithproof]

Confirmed unresolved on current develop. trim($value, " =+-@") mutates legitimate data and does not provide correct formula neutralization. PR #326 hardens the alert-log export but leaves the main syslog export on the trim-based behavior; PR #320 hardens the main path. This issue should stay open until one reviewed PR covers both export branches, preserves content, handles leading space/tab/CR plus = + - @, and has executed regression coverage.