feat(commands): per-chat album scope derived from notification routing

The "per-chat album scope" feature stored on CommandTrackerListener was
really per-bot: listener_id = bot.id, and every chat that bot served
shared the same scope.  Commands like /albums, /random, /status,
/events leaked the full provider catalog into chats that were never
wired up to receive notifications from those trackers.

New model: the album scope for /commands in a given chat is derived
from the notification-routing graph.  For a (provider, bot, chat_id)
triple we walk TargetReceiver (chat_id match, enabled) →
NotificationTarget (telegram or broadcast parent) →
NotificationTrackerTarget → NotificationTracker (provider match) and
union their collection_ids.  That's the natural "what does this chat
get notifications about" set, and it becomes the command scope.

- New helper: command_utils.resolve_chat_album_scope(provider_id,
  bot_id, chat_id) -> set[str].  Empty set is the default for chats
  with no routing — commands return nothing rather than leaking the
  provider's catalog.
- Dispatcher computes the scope per (tracker, bot, chat) and threads
  it through handler.handle(..., allowed_album_ids=...).  Explicit
  CommandTrackerListener.allowed_album_ids override, when set, still
  wins verbatim (kept as an escape hatch for users who want a divergent
  scope for a whole bot).
- /status, /albums, /events, and all /_cmd_immich-routed commands
  (/random, /search, /find, /latest, /memory, /summary, /favorites,
  /place, /person) now intersect with the resolved scope.
- UI scope modal relabeled: it's an explicit *override for this bot*,
  not a per-chat setting.  Default is "derive from notification
  routing", which matches what users already configured elsewhere.

Also:
- /search, /find, /person, /place — _enrich_assets return value was
  discarded, dropping public_url enrichment.  Assign the return value.
- search_smart / search_metadata — consolidated into _search_items
  helper that logs non-200 responses and transport errors instead of
  silently returning [].  Makes "always no results" bugs actually
  diagnosable.  Also accepts the alternate {"assets": [...]} flat-list
  shape from older Immich versions.
- Immich search error bodies go through _redact_body so credentials
  echoed by authenticating proxies don't land in server logs.

packages/server/src/notify_bridge_server/commands/immich/search.py

@@ -31,7 +31,7 @@ async def cmd_search(
     if not args:
         return _render_cmd_template(cmd_templates, "no_results", locale, {"command": "search", "query": ""})
     assets = await client.search_smart(args, album_ids=all_album_ids, limit=count, page=page)
-    _enrich_assets(assets, asset_public_urls or {})
+    assets = _enrich_assets(assets, asset_public_urls or {})
     return _format_assets(assets, "search", args, locale, response_mode, client, cmd_templates)
 
 
@@ -46,7 +46,7 @@ async def cmd_find(
     if not args:
         return _render_cmd_template(cmd_templates, "no_results", locale, {"command": "find", "query": ""})
     assets = await client.search_metadata(args, album_ids=all_album_ids, limit=count, page=page)
-    _enrich_assets(assets, asset_public_urls or {})
+    assets = _enrich_assets(assets, asset_public_urls or {})
     return _format_assets(assets, "find", args, locale, response_mode, client, cmd_templates)
 
 
@@ -68,7 +68,7 @@ async def cmd_person(
     if not person_id:
         return _render_cmd_template(cmd_templates, "no_results", locale, {"command": "person", "query": args})
     assets = await client.search_by_person(person_id, limit=count)
-    _enrich_assets(assets, asset_public_urls or {})
+    assets = _enrich_assets(assets, asset_public_urls or {})
     return _format_assets(assets, "person", args, locale, response_mode, client, cmd_templates)
 
 
@@ -84,5 +84,5 @@ async def cmd_place(
     assets = await client.search_smart(
         f"photos taken in {args}", album_ids=all_album_ids, limit=count
     )
-    _enrich_assets(assets, asset_public_urls or {})
+    assets = _enrich_assets(assets, asset_public_urls or {})
     return _format_assets(assets, "place", args, locale, response_mode, client, cmd_templates)