docs(bags): add SAFETY comment for SQL string interpolation

Document why direct format!() interpolation is acceptable in
build_where_clause(): the values are type-safe (bool outputs literal
TRUE/FALSE, roast_id is i64 from typed wrapper). Warns future
developers to use parameterized queries if string fields are added.

src/infrastructure/repositories/bags.rs

@@ -84,6 +84,10 @@ impl SqlBagRepository {
     fn build_where_clause(filter: &BagFilter) -> Option<String> {
         let mut conditions = Vec::new();
 
+        // SAFETY: Direct interpolation is safe here because:
+        // - `closed` is a bool, outputting literal "TRUE"/"FALSE"
+        // - `roast_id` is an i64 from a typed wrapper
+        // If adding string-based filters, use parameterized queries instead.
         if let Some(closed) = filter.closed {
             conditions.push(format!(
                 "b.closed = {}",