fix(marketing): bento autoescape + dead col-span + test gaps

- Pipe macro title/description through | safe to render NBSP/& correctly
  (autoescape was producing literal '95 %+' and 'Q&R' text on screen)
- Replace dynamic col-span-{{ span }} with static lookup table so Tailwind
  scanner generates the utilities for A-2.7+ reuse
- Replace inline border style with border-white/[0.045] utility (codebase consistency)
- Add explicit Q&R assertion + autoescape regression guard test

tests/test_marketing_landing_template.py

@@ -255,6 +255,8 @@ def test_bento_has_6_features():
     # Watermark numbers 01..06
     for n in ['01', '02', '03', '04', '05', '06']:
         assert f'>{n}<' in body, f"Missing bento watermark number {n}"
+    # Card 04 must use French Q&R, not English Q&A — primary identifier check
+    assert 'Q&amp;R' in body or 'Q&R' in body, "Card 04 must use French Q&R, not Q&A"
 
 
 def test_bento_uses_flexihub_styling():
@@ -281,3 +283,20 @@ def test_bento_uses_wcag_safe_text_on_dark():
     client = app.test_client()
     body = client.get('/').data.decode('utf-8')
     assert 'text-white/70' in body, "Missing WCAG-safe /70 text opacity on dark cards"
+
+
+def test_bento_renders_nbsp_entities_not_escaped():
+    """Card 01 '95 %+' NBSP must render as a non-breaking space, not as literal '&nbsp;' text.
+
+    Regression guard: if the bento macro stops piping description through `| safe`,
+    Jinja autoescape will double-escape '&nbsp;' to '&amp;nbsp;' and users see the
+    raw entity. The HTML response must contain the literal '95&nbsp;%+' once
+    (single escape), never '95&amp;nbsp;%+'.
+    """
+    client = app.test_client()
+    body = client.get('/').data.decode('utf-8')
+    assert '95&nbsp;%+' in body, "NBSP entity should appear single-escaped in card 01"
+    assert '95&amp;nbsp;' not in body, "NBSP entity must not be double-escaped (missing | safe?)"
+    # Q&R card title: French ampersand must survive as &amp; in HTML, not &amp;amp;
+    assert 'Q&amp;R' in body, "Q&R title should appear single-escaped"
+    assert 'Q&amp;amp;R' not in body, "Q&R title must not be double-escaped"