bxctl: escape frame errors; say the outcome is unknown after a timeout

From the independent review of task 23. serde quotes a bad frame's text after
decoding, so a compromised peer could put escape sequences in it. A timed-out
admin request now says whether brokerd acted is unknown, since it may have.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

crates/bxctl/src/chat.rs

@@ -24,7 +24,8 @@ impl std::fmt::Display for ChatError {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
             ChatError::Connect(e) => write!(f, "{e}"),
-            ChatError::Frame(e) => write!(f, "{e}"),
+            // serde quotes the offending text of a bad frame, decoded: escape it.
+            ChatError::Frame(e) => write!(f, "{}", escape_json_text(&e.to_string())),
             // The detail may carry the inference server's body: escape it like model text.
             ChatError::Refused(w) => {
                 write!(f, "{}: {}", code_name(w.code), escape_json_text(&w.detail))