fix: build execution result JSON via json.Marshal (was stuck at 'approved')

The final "UPDATE executions SET result=$::jsonb" built its payload with
fmt.Sprintf and only escaped newlines. apt/pct output contains quotes,
backslashes and control chars, so the payload was invalid JSON, the jsonb
cast failed, and the (unchecked) UPDATE was silently discarded — the
execution stayed 'approved' with a NULL result even though the LXC was fully
provisioned (verified live: vmid auto-assigned, container running, service
installed, post_install ran).

- executeApprovedAction: marshal result via json.Marshal; log UPDATE errors
- add jsonErr() helper; route all pct_create failure-path results through it
- mcp/server.go: add jsonOut() for restart/systemctl/pct_exec inline results
- regression test for JSON validity on quote/backslash/control-char output

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/httpapi/pct_create_test.go

@@ -68,6 +68,25 @@ func TestResolveTemplate(t *testing.T) {
 	}
 }
 
+// TestJSONErrValidForNastyOutput guards the bug where command output with
+// quotes/backslashes/newlines produced invalid JSON, failing the ::jsonb cast
+// and silently dropping the execution's final status update.
+func TestJSONErrValidForNastyOutput(t *testing.T) {
+	nasty := "CT 132 already exists on node \"hubris\"\n\tpath C:\\x\r\n\x00 100%"
+	for _, payload := range [][]byte{
+		jsonErr("%s", nasty),
+		jsonErr("list templates on %s: %s", "host:strong", nasty),
+	} {
+		var m map[string]any
+		if err := json.Unmarshal(payload, &m); err != nil {
+			t.Fatalf("jsonErr produced invalid JSON: %v\npayload=%s", err, payload)
+		}
+		if _, ok := m["error"]; !ok {
+			t.Errorf("missing error key: %s", payload)
+		}
+	}
+}
+
 func TestSanitizePkgs(t *testing.T) {
 	in := []string{"docker.io", "git", "rm -rf /", "curl;wget", "python3-pip", ""}
 	got := sanitizePkgs(in)