fix: check thumbnail directory containment with a real path test

clear_thumbnails compared resolved paths with str.startswith, so a
thumbnails directory that resolved to a sibling with a shared prefix
(out vs out2) passed the safety check and was emptied. It now uses the
module's _is_within (realpath + normcase + Path.is_relative_to).

py/api/images.py

@@ -1049,15 +1049,12 @@ class ImageRoutesMixin:
                     }
                 )
 
-            # Verify this is actually our thumbnails directory
+            # Verify this is actually our thumbnails directory: a real child
+            # of the output root (symlinks resolved), not merely a path that
+            # shares its prefix such as "<root>2/thumbnails".
             try:
-                thumbnails_dir_resolved = thumbnails_dir.resolve()
-                output_path_resolved = output_path.resolve()
-
                 if (
-                    not str(thumbnails_dir_resolved).startswith(
-                        str(output_path_resolved)
-                    )
+                    not _is_within(thumbnails_dir, output_path)
                     or thumbnails_dir.name != "thumbnails"
                 ):
                     self.logger.error(