todos array. Data flows down by assigning
list.items = todos (a real array — no globals, no eval), and actions flow
up as bubbling CustomEvents (toggle, remove)
that the page listens for. Components hold no state and no business logic.
Interpolated text is HTML-escaped, so try adding <img src=x onerror=alert(1)> as a todo.