bookAnnounced webhook text is not run through notifier.SafeText, so a provider title can forge mentions and links #2676

Pre-flight

• I searched existing issues and this isn't a duplicate
• I checked the roadmap and this isn't already planned

Problem

The bookAnnounced webhook (#2236) puts provider supplied text into a notification payload. announceText in internal/api strips control characters and caps the length, but it does not neutralise chat mentions, Slack escapes, markdown links or URL schemes.

OpenLibrary is publicly editable, so a book title can carry @everyone, a Slack <!channel>, or a masked markdown link. When the webhook target is Discord, Slack or a relay such as Apprise, that renders as a real mention or a clickable link in the operator's channel.

The requester role work (#2670) added notifier.SafeText, which already handles all of these vectors and has tests per vector.

Proposed solution

Route the bookAnnounced payload fields through notifier.SafeText instead of announceText, and delete the weaker helper if nothing else uses it. Keep one sanitiser in the notifier package so any future event gets the same treatment.

Additional context

Both features merged in the same batch. The rebase of #2670 deliberately left announceText alone rather than change a merged feature's webhook output mid rebase, so this is the follow up.