fix: image and URL references refuse a /\ path, which browsers read as another host (WR-20)

safeImageURL and ValidURLRef refused only //, so a stored og_image of
/\evil.example/x.png loaded a third-party image in the admin. Both now
refuse /\ like models.validTarget already does.

assets/src/elements/image.ts

@@ -2,9 +2,13 @@ import { el, emit, labelsFor, uid, uiLocaleOf, type Labels } from './labels'
 
 export const IMAGE_TAG = 'golem15-seo-image'
 
-/** Whether a stored image URL may be shown: a path or an http(s) URL. */
+/**
+ * Whether a stored image URL may be shown: a path or an http(s) URL. A
+ * path starting with // or /\ is refused: browsers read both as another
+ * host (like classes.ValidURLRef).
+ */
 export function safeImageURL(url: string): boolean {
-  return /^\/(?!\/)/.test(url) || /^https?:\/\//i.test(url)
+  return /^\/(?![\/\\])/.test(url) || /^https?:\/\//i.test(url)
 }
 
 /**