[geoffrey-wu]

Summary

• Add escapeRegExp in shared/string-utils.js and replace the two identical copies in database/qbreader/get-query.js and get-pg-lookup.js.
• Add escapeCSVField in shared/string-utils.js and replace the three separate CSV escapers (client/scripts/download.js, client/db/frequency-list/subcategory.jsx, client/play/geoword/admin/users.js). The geoword users export keeps its formula-injection guard via { neutralizeFormulas: true }; other exports are unchanged in that respect.
• Remove the local titleCase in subcategory.jsx in favor of shared/string-utils.js.

Behavior notes

• Line breaks in CSV fields are now consistently written as a literal \n (previously download.js handled only \n, and the geoword users export left them raw).

Not changed

• Stats CSV exports (client/user/stats/*) still use row.join(',').
• users.js still builds its own Blob; downloadAsFile uses a data URI, which can hit size limits on large exports.

Test plan

• npx semistandard, npm run build
• Spot-checked both helpers in node
• Download CSV from the db page, frequency list, and geoword admin users page

🤖 Generated with Claude Code