csvCell() prefixed an apostrophe to any cell whose *string* form starts
with =, +, - or @, applied to every column including numeric ones.
transactions.total_cents is legitimately negative for a net-Pfand-refund
transaction (more deposit returned than drinks bought) — a refund
exported as '-600 in that column, which Excel/LibreOffice import as text,
so SUM() over the column silently skips it. Whoever reconciles the till
against the CSV gets a total too high by the sum of all refunds, exactly
the direction that makes a short drawer look correct.
Numbers now bypass both the injection guard and the quote-escaping below
it — the guard exists for free-text columns that could carry a formula
payload, and numbers never contain the characters the escaping handles
anyway.
6d88d34291