fix: escape HTML angle brackets in midi-demo card renderer

<S> in flag text (e.g. --strength <S>, --min-score <S>) was parsed by the browser as the <s> (strikethrough) element, bleeding strikethrough through the rest of each card. Add an esc() helper and apply it to cmd, desc, flags, and ret before inserting into innerHTML. The example field is left unescaped as it contains intentional HTML span tags.