{{-- The Customer cell of the Customer Documents listing — the row's FIRST dropdown (CR-15 decision D4, client instruction §1: "In Customer column show Drop Down with Customer name and customer co-applicant. Default customer selected."). Rendered by CustomerDocumentsDataTable through rawColumns(['customer']), which means this output is injected into the page unescaped. Nothing user-controlled reaches it unescaped: the names go out through `{{ }}` like everything else, and the payload goes out as an html-escaped attribute — `{{ json_encode(...) }}` is `e(json_encode(...))`, so a customer called `">