fix: address multiple bugs found in code review

- Fix dirty-user flush race: discard IDs individually after successful save
- Escape LIKE wildcards in LLM-generated topic keywords for DB queries
- Anonymize absent-member aliases to prevent LLM de-anonymization
- Pass correct MIME type to vision model based on image file extension
- Use enumerate instead of list.index() in bcs-scan loop
- Allow bot @mentions with non-report intent to fall through to moderation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

utils/database.py

@@ -628,7 +628,8 @@ class Database:
                 return []
             # Build OR conditions for each keyword
             conditions = " OR ".join(["Topics LIKE ?" for _ in topic_keywords])
-            params = [limit, user_id] + [f"%{kw}%" for kw in topic_keywords]
+            escaped = [kw.replace("%", "[%]").replace("_", "[_]") for kw in topic_keywords]
+            params = [limit, user_id] + [f"%{kw}%" for kw in escaped]
             cursor.execute(
                 f"""SELECT TOP (?) Memory, Topics, Importance, CreatedAt
                     FROM UserMemory

utils/llm_client.py

@@ -865,13 +865,14 @@ class LLMClient:
         system_prompt: str,
         user_text: str = "",
         on_first_token=None,
+        media_type: str = "image/png",
     ) -> str | None:
         """Send an image to the vision model with a system prompt.
 
         Returns the generated text response, or None on failure.
         """
         b64 = base64.b64encode(image_bytes).decode()
-        data_url = f"data:image/png;base64,{b64}"
+        data_url = f"data:{media_type};base64,{b64}"
 
         user_content: list[dict] = [
             {"type": "image_url", "image_url": {"url": data_url}},