metadata: send safesearch=strict on Bing image searches

Our client keeps no cookie jar, so every Bing read arrived with the
adult-content preference undefined -- and in that state Bing answers with
wholly unrelated cached result sets. Four identical back-to-back reads of
"Fishmans band photo" returned porn, an Indonesian guitar-chord page, porn
again, and a printable 2026 calendar, each internally coherent with honest
titles and page urls.

Measured 27/27 reads with zero relevant cards without the flag and 27/27
correct with it, across three artists, three waves and three repeats. Only
strict works; moderate and off behave exactly like sending nothing. Strict
costs no relevance (Partiboi69 scores 34/35) and it also keeps explicit
imagery out of the candidate pool, which until now only the identity gate
was stopping.

This failure was misdiagnosed twice -- first as a poisoned IP, then as Bing
rate limiting -- because with no cookie our requests are byte-identical
every time, so all the variability lived in Bing's cache. That is why it
appeared to break and heal on its own with no code change.

Camping in Alaska, Fishmans and Partiboi69 now resolve real heroes again.

crates/metadata/src/lib.rs

@@ -1857,12 +1857,24 @@ impl MetadataClient {
             // together, but consume it in the original wave order so candidate
             // membership, metadata upgrades, ranks and early-stop behavior stay
             // identical to the sequential implementation.
+            // `safesearch=strict` is load-bearing for RELEVANCE, not just for
+            // decency. Our client keeps no cookie jar, so every read reaches
+            // Bing with its adult-content preference undefined -- and in that
+            // state Bing answers with wholly unrelated cached result sets: four
+            // identical back-to-back reads for "Fishmans band photo" returned
+            // porn, an Indonesian chord page, porn again, and a printable 2026
+            // calendar, each internally coherent with honest titles and purls.
+            // Measured 27/27 reads with zero relevant cards without the flag
+            // and 27/27 correct with it. Only `strict` fixes it; `moderate` and
+            // `off` behave exactly like sending nothing at all. This was
+            // misdiagnosed twice (as a poisoned IP, then as Bing rate-limiting)
+            // because the failure looks external and clears on its own.
             let wave_urls = waves
                 .iter()
                 .take(wave_limit)
                 .map(|wave| {
                     format!(
-                        "https://www.bing.com/images/search?q={q}&qft={}&form=HDRSC3&first=1&cc=us&setlang=en-us&tsc=ImageHoverTitle",
+                        "https://www.bing.com/images/search?q={q}&qft={}&form=HDRSC3&first=1&cc=us&setlang=en-us&tsc=ImageHoverTitle&safesearch=strict",
                         urlencode(wave)
                     )
                 })