Fix SSP/escape bugs, harden column helpers, add tests, docs & CI

[milkway]

Review pass over the package: two real bugs fixed, the options$columns footgun closed, JS-string interpolation hardened, a test suite added, plus documentation/site/CI improvements. Closes #1, #2, #3, #4, #5, #6.

Bug fixes

• dt2_cols_escape() — both branches of if (escape) returned the same identity renderer, so the parameter was a no-op and the default escape = TRUE rendered raw HTML instead of escaping it (XSS-prone with untrusted data). Now escapes when TRUE, renders raw when FALSE.
• Server-side processing — dt2.js encodes query-string keys with encodeURIComponent (search[value] → search%5Bvalue%5D, order[0][column] → order%5B0%5D…), but .dt2_parse_ssp_request() only decoded values. Global search and ordering were therefore silently never applied. Keys are now URL-decoded.

Improvements

• options$columns footgun — dt2() now injects options$columns from the data when absent (equivalent to dt2.js's client-side derivation), and a new internal .dt2_name_to_idx() centralises name→index resolution and warns instead of silently returning NA when columns are unset or a name is unknown. All name-based helpers use it.
• Safer JS interpolation — .dt2_js_str() (via jsonlite) replaces sprintf("'%s'", x) in the format helpers, fixing invalid JS when values contain quotes.
• Removed redundant local %||% redefinitions and dead .dt2_resolve_cols(); print.dt2_theme() now shows the class field.

Tests

• New testthat scaffolding + 43 tests covering the fixed bugs and the new behaviour (escape, SSP key decoding, column resolution/warnings, JS-string safety, theme print). All passing locally.

Docs, site & CI

• Logo rebuilt as man/figures/logo.svg with explicit dimensions/padding (was clipping the bottom) and renamed from diagrama-2025-09-11.svg; README uses it. (Use the sharper logo.svg in the README #6)
• Real R-CMD-check GitHub Actions workflow; README badge now points to the live run instead of a static badge. (Add real R-CMD-check CI workflow (badge currently static) #1)
• Runnable @examples for dt2_order, dt2_search_global, dt2_use_buttons, dt2_language. (Add runnable @examples to 4 exported helpers #2)
• Documented the tidytemplate build dependency in _pkgdown.yml. (Document the tidytemplate build dependency in _pkgdown.yml #3)
• Explained the options$columns pattern in the formatting & getting-started vignettes. (Explain the options$columns pattern in vignettes #4)
• Reciprocal @seealso between dt2_buttons() and dt2_use_buttons(). (Clarify overlap between dt2_buttons() and dt2_use_buttons() #5)
• Grouped pkgdown reference index (was a flat list of 41 functions); README version badge 0.1.0→0.1.1, CRAN install instructions, author credits aligned to DESCRIPTION (5 authors).
• Migrated to roxygen2 8.

Notes for the reviewer

• Behaviour changes in SSP, escaping, and column helpers — worth a full devtools::check() before merge (CI will now run it too).
• No public functions were removed (CRAN API preserved).

🤖 Generated with Claude Code