Map SAB storage root safely

Only treat configured manual storage as Importarr-owned and map SAB container paths to local paths.

importarr/config.py

@@ -10,6 +10,7 @@ class Settings(BaseModel):
     sab_url: str = "http://sabnzbd:8080"
     sab_api_key: str | None = None
     sab_category: str = "manual"
+    sab_storage_root: Path | None = None
     download_root: Path = Path("/data/downloads/manual")
     movies_root: Path = Path("/data/movies")
     tv_root: Path = Path("/data/tv")
@@ -30,6 +31,7 @@ class Settings(BaseModel):
             sab_url=os.getenv("IMPORTARR_SAB_URL", cls.model_fields["sab_url"].default),
             sab_api_key=_env_secret("IMPORTARR_SAB_API_KEY"),
             sab_category=os.getenv("IMPORTARR_SAB_CATEGORY", "manual"),
+            sab_storage_root=Path(os.getenv("IMPORTARR_SAB_STORAGE_ROOT")) if os.getenv("IMPORTARR_SAB_STORAGE_ROOT") else None,
             download_root=Path(os.getenv("IMPORTARR_DOWNLOAD_ROOT", "/data/downloads/manual")),
             movies_root=Path(os.getenv("IMPORTARR_MOVIES_ROOT", "/data/movies")),
             tv_root=Path(os.getenv("IMPORTARR_TV_ROOT", "/data/tv")),