security: Validate and sanitize BookDB response data before trusting

[deucebucket]

Problem

LM trusts BookDB API response data without sufficient validation. If BookDB is compromised, returns corrupted data, or a MITM intercepts responses, LM could:

1. Path traversal via metadata — BookDB returns author/title containing ../ or path separators, which flows into rename operations
2. XSS via metadata — BookDB-sourced author/title with HTML/JS could reach templates
3. SQL injection via metadata — Raw strings from API responses used in queries
4. Oversized fields — No length limits on API response fields could cause memory issues

LM already has sanitize_path_component() for file operations, but the validation should happen earlier — at the point of ingestion from the API.

Fix

Add response validation in library_manager/providers/bookdb.py:

• Sanitize and length-limit all string fields from API responses (title, author, narrator, series)
• Strip control characters, null bytes, and HTML tags
• Reject responses where critical fields are missing or suspiciously formatted
• Log warnings when sanitization modifies data (indicates potential issue)

Also verify that existing path sanitization covers BookDB-sourced data before it hits filesystem operations.

Files

• library_manager/providers/bookdb.py — add response sanitization
• library_manager/providers/fingerprint.py — same for fingerprint responses