fix(iptv): XML-escape advertised base URL in XMLTV guide output (#340 review)

Independent review found that AdvertisedBaseUrl.TryParse accepts a path
prefix containing '&' (a legal URL-path char kept out of uri.Query), but
GetChannelGuideHandler substituted {RequestBase} raw into pre-built XML
written unescaped — so a configured base like https://host/a&b emitted a
bare '&', malforming the entire XMLTV guide (clients reject the document).

Escape the substituted base with SecurityElement.Escape before the raw
replace, mirroring how {AccessTokenUri} is already pre-escaped (&).
No-op for normal URLs (goldens unchanged); M3U output is untouched (M3U
isn't XML). Adds a regression test asserting '&' → '&' in the guide.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ErsatzTV.Application/Channels/Queries/GetChannelGuideHandler.cs

@@ -1,5 +1,6 @@
 using System.Collections.Immutable;
 using System.IO.Abstractions;
+using System.Security;
 using System.Text;
 using System.Text.RegularExpressions;
 using ErsatzTV.Core;
@@ -36,7 +37,11 @@ public partial class GetChannelGuideHandler(
             request.Host,
             request.BaseUrl);
 
-        string requestBase = $"{scheme}://{host}{baseUrl}";
+        // The cache fragments are pre-built XML written raw (like {AccessTokenUri}, which is already
+        // emitted as &), so the substituted base must be XML-escaped. A path prefix can legally
+        // contain '&' (Uri keeps it out of the query), which would otherwise emit a bare '&' and
+        // malform the whole guide. Normal URLs have no special chars, so this is a no-op for them.
+        string requestBase = SecurityElement.Escape($"{scheme}://{host}{baseUrl}");
         var hiddenChannelNumbers = dbContext.Channels
             .Where(c => c.ShowInEpg == false)
             .Select(c => c.Number)

ErsatzTV.Core.Tests/Iptv/ChannelGuideGoldenTests.cs

@@ -146,6 +146,47 @@ public class ChannelGuideGoldenTests
         xml.ShouldNotContain(Host);
     }
 
+    // A configured base URL whose path prefix contains an XML-special character ('&' is a legal URL
+    // path char, so it passes AdvertisedBaseUrl validation) must be XML-escaped when substituted into
+    // the guide fragments — otherwise a bare '&' malforms the whole document. (Reviewer finding, #340.)
+    [Test]
+    public async Task Guide_xml_escapes_advertised_base_url()
+    {
+        MockFileSystem fileSystem = BuildCacheFileSystem();
+        var localFileSystem = Substitute.For<ILocalFileSystem>();
+        localFileSystem
+            .ListFiles(FileSystemLayout.ChannelGuideCacheFolder)
+            .Returns(new[]
+            {
+                FragmentPath(fileSystem, "channels.xml"),
+                FragmentPath(fileSystem, "2.xml")
+            });
+
+        var configElementRepository = Substitute.For<IConfigElementRepository>();
+        configElementRepository
+            .GetValue<string>(Arg.Any<ConfigElementKey>(), Arg.Any<CancellationToken>())
+            .Returns(Option<string>.Some("https://tv.example.com/a&b"));
+
+        var handler = new GetChannelGuideHandler(
+            _dbContextFactory,
+            new RecyclableMemoryStreamManager(),
+            fileSystem,
+            localFileSystem,
+            configElementRepository);
+
+        Either<BaseError, ChannelGuide> result = await handler.Handle(
+            new GetChannelGuide(Scheme, Host, BaseUrl: "", AccessToken: null),
+            CancellationToken.None);
+
+        string xml = result.Match(
+            Right: guide => guide.ToXml(),
+            Left: error => throw new AssertionException($"Handler returned error: {error.Value}"));
+
+        // The '&' from the base URL must be emitted as '&amp;', never a bare '&'.
+        xml.ShouldContain("https://tv.example.com/a&amp;b/iptv/logos/news.jpg");
+        xml.ShouldNotContain("a&b");
+    }
+
     // --- harness ---
 
     private async Task Verify(string goldenName, GetChannelGuide request)