Authenticated arbitrary file write via unanchored slug validation

Path traversal in Enchanted Code Note Mark before 0.19.5 allows remote authenticated users to write files via crafted book or note slugs. The book and note slug patterns are unanchored, and the export commands pass stored slugs to path.Join before creating directories and note files. A low-privilege account must store a traversal slug and an administrator must later run migrate export; a root-run export writes attacker-influenced content outside its destination.