fn sanitize(s: &str) -> String
Filename sanitisation: replace path separators + spaces with _. Belt-and-braces; the wire types should already constrain these strings to URL-safe shapes, but we don’t trust the input.
_