[M-24] closeEscalation notes not purified; slug derived from user input

Resolved.

Two changes in AdminModerationController::closeEscalation (src/Controllers/AdminModerationController.php):

1. Slug validation: the $threadSlug derived from report.source_url is checked against /^escalation-[0-9a-f]{8}$/ (the exact shape ForumController::escalate mints). A poisoned source_url stored at report-creation time can no longer redirect the admin reply into an unrelated thread.
2. Notes purification: $notes now runs through MarkdownService::purify() before being interpolated into the reply body; $verdict and $actor['username'] run through htmlspecialchars(ENT_QUOTES).

Locking this thread.