fix: sanitise trip slug on input, escape single quotes in YAML frontmatter

Fix D: apply _sanitise_slug() to grav_trip_slug in POST /select before
storing in TripState, preventing path traversal via ../sequences.

Fix E: add _yaml_str() helper that doubles single quotes; apply to title,
location_city, and location_country in both run_export and overwrite_export
frontmatter blocks, preventing invalid YAML for values like Xi'an.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

services/travel-memories/app/routes/albums.py

@@ -1,3 +1,4 @@
+import re
 from pathlib import Path
 
 from flask import Blueprint, current_app, redirect, render_template, request
@@ -7,6 +8,12 @@ from app.state import TripState, Photo, load_state, save_state
 bp = Blueprint("albums", __name__)
 
 
+def _sanitise_slug(s: str) -> str:
+    s = s.strip().lower()
+    s = re.sub(r'[^a-z0-9-]+', '-', s)
+    return s.strip('-')
+
+
 def _client():
     return ImmichClient(current_app.config["IMMICH_URL"],
                         current_app.config["IMMICH_API_KEY"])
@@ -31,7 +38,7 @@ def index():
 @bp.post("/select")
 def select():
     album_ids = request.form.getlist("album_ids[]")
-    grav_trip_slug = request.form["grav_trip_slug"].strip()
+    grav_trip_slug = _sanitise_slug(request.form["grav_trip_slug"])
     start_over = request.form.get("start_over") == "1"
 
     if len(album_ids) == 1: