docs: record why the misplaced-rows LIKE needs no escaping (4245)

`startswith` compiles to LIKE, where `_` and `%` are wildcards, and the call
does not escape them. That is safe only because `slugify` reduces a slug to
[a-z0-9-] — an invariant living in a different module, which is exactly the
kind of thing that gets widened later without anyone connecting the two.

Worth naming because `poch4n_art` is a real directory here: if slugs ever
carried underscores, that prefix would start matching `poch4nXart` and the
sweep would quietly mis-file one artist's rows.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVjrnpQjRgHdvq95rASoiR

backend/app/services/library_layout.py

@@ -54,6 +54,12 @@ def _misplaced_conditions(images_root: Path, artist_id: int, slug: str) -> list:
     `ara` would match every path under `arbuzbudesh/`, and the sweep would
     report one artist's whole library as correctly placed while quietly
     skipping another's.
+
+    `startswith` compiles to LIKE, where `_` and `%` are wildcards, and this
+    does not escape them. That is safe ONLY because `utils.slug.slugify`
+    reduces a slug to `[a-z0-9-]` — neither character can reach the pattern.
+    Widen that charset and this needs `autoescape=True`, or `poch4n_art`
+    starts matching `poch4nXart` too.
     """
     prefix = f"{canonical_dir(images_root, slug)}/"
     return [