fix: sanitize_stem handles path-like stems with leading dots

Path(".._evil").stem returns "." and fell back to the default "photo".
Strip leading/trailing dots before Path.stem so "../evil" becomes "evil".

app/pipeline.py

@@ -307,10 +307,11 @@ _UNSAFE_STEM_RE = re.compile(r"[^\w.\-]+", re.UNICODE)
 
 def sanitize_stem(name: str) -> str:
     """Safe basename stem for flat files (no path separators / junk)."""
-    # Replace separators before Path.stem so "a/b" → "a_b", not "b".
+    # Replace separators before Path.stem so "a/b" -> "a_b", not "b".
     stem = (name or "").replace("/", "_").replace("\\", "_")
-    stem = Path(stem).stem
+    # Strip leading/trailing dots first; Path(".._evil").stem returns ".".
     stem = stem.strip().strip(".")
+    stem = Path(stem).stem
     stem = _UNSAFE_STEM_RE.sub("_", stem).strip("._")
     return stem or "photo"