feat: Google Photos provider backend + API hardening

- Add Google Photos provider: client, models, change detector, capabilities
- Add notification templates (en/ru) for all GP event slots
- Add command templates (en/ru) for GP bot commands
- Register GP in slot/command loaders, capabilities, and seeds
- Harden provider API: validate OAuth credentials on create/update
- Add internal URL rewriting for asset fetches (LAN optimization)
- Fix template renderer to handle missing variables gracefully
- Improve webhook command routing for multi-provider support
- Add provider health check endpoint and watcher improvements

packages/server/src/notify_bridge_server/config.py

@@ -33,8 +33,8 @@ class Settings(BaseSettings):
 
     telegram_webhook_secret: str = ""
 
-    cors_allowed_origins: str = "*"
-    """Comma-separated allowed origins for CORS (e.g. 'http://localhost:5173,https://myapp.com'). Use '*' for dev."""
+    cors_allowed_origins: str = "http://localhost:5173"
+    """Comma-separated allowed origins for CORS (e.g. 'http://localhost:5173,https://myapp.com')."""
 
     static_dir: str = ""
     """Path to frontend static files. Set to serve SvelteKit build via FastAPI (e.g. /app/static in Docker)."""