feat(trackers): user filters for Gitea, webhook polling cleanup, dashboard navigability

- Gitea: NotificationTracker now exposes sender allowlist / blocklist filters
  via MultiEntitySelect, populated from Gitea /users/search merged with past
  EventLog senders so the picker is useful before the first webhook arrives.
- Webhook providers (gitea, planka, webhook): stop scheduling interval polling
  jobs on tracker create/update/startup; hide the "every Xs" indicator in the
  tracker list since there is no polling.
- Dashboard: stat cards are now <a> links that route to providers, trackers,
  targets, command-trackers, or scroll to the events panel. Provider deck
  rows highlight the target provider on click.
- Command trackers / command configs: auto-reselect the right config when the
  provider type changes (matches notification-tracker behavior).
- Migration: drop legacy batch_duration column from notification_tracker —
  the field is gone from the model but its NOT NULL constraint blocked
  inserts on older DBs.
- Docs: refresh entity-relationships.md with current NotificationTracker
  fields (filters, adaptive_max_skip, default_*_config_id).

packages/server/src/notify_bridge_server/api/providers.py

@@ -12,7 +12,7 @@ import aiohttp
 
 from ..auth.dependencies import get_current_user
 from ..database.engine import get_session
-from ..database.models import ServiceProvider, User
+from ..database.models import EventLog, ServiceProvider, User
 from ..services import (
     make_immich_provider, make_gitea_provider, make_planka_provider,
     make_nut_provider, make_google_photos_provider, list_provider_collections,
@@ -398,6 +398,62 @@ async def list_collections(
     return await list_provider_collections(provider)
 
 
+@router.get("/{provider_id}/users")
+async def list_provider_users(
+    provider_id: int,
+    user: User = Depends(get_current_user),
+    session: AsyncSession = Depends(get_session),
+) -> list[dict[str, str]]:
+    """Return user identities for sender allowlist/blocklist pickers.
+
+    Two sources are merged so the picker is useful both before and after the
+    first webhook arrives:
+
+    - **Provider API** (primary): Gitea's ``/users/search`` returns instance
+      users the api_token can see. Skipped when no api_token is set.
+    - **Past senders** (fallback): distinct ``sender`` values from
+      ``EventLog.details`` for this provider, so pre-existing trackers stay
+      filterable even if the API call fails or is unconfigured.
+    """
+    provider = await _get_user_provider(session, provider_id, user.id)
+
+    users_by_id: dict[str, str] = {}
+
+    # 1. Try the provider API.
+    if provider.type == "gitea" and (provider.config or {}).get("api_token"):
+        from notify_bridge_core.providers.gitea.client import GiteaClient
+        http_session = await get_http_session()
+        client = GiteaClient(
+            http_session,
+            provider.config.get("url", ""),
+            provider.config.get("api_token", ""),
+        )
+        try:
+            for u in await client.get_users():
+                login = u.get("login", "")
+                if isinstance(login, str) and login:
+                    users_by_id[login] = u.get("full_name") or login
+        except Exception:
+            _LOGGER.warning("Failed to fetch Gitea users via API", exc_info=True)
+
+    # 2. Merge in past senders (covers users not visible to the API token, or
+    #    cases where the API call fails).
+    result = await session.exec(
+        select(EventLog.details).where(EventLog.provider_id == provider.id)
+    )
+    for details in result.all():
+        if not isinstance(details, dict):
+            continue
+        sender = details.get("sender", "")
+        if isinstance(sender, str) and sender and sender not in users_by_id:
+            users_by_id[sender] = sender
+
+    return [
+        {"id": login, "name": name}
+        for login, name in sorted(users_by_id.items(), key=lambda kv: kv[0].lower())
+    ]
+
+
 @router.get("/{provider_id}/albums/{album_id}/shared-links")
 async def get_album_shared_links(
     provider_id: int,

packages/server/src/notify_bridge_server/database/migrations.py

@@ -197,6 +197,21 @@ async def migrate_schema(engine: AsyncEngine) -> None:
                 )
                 logger.info("Added filters column to %s table", tracker_table)
 
+        # Drop legacy batch_duration column from notification_tracker.
+        # The field was removed from the SQLModel class but the column still
+        # exists as NOT NULL in older DBs, so INSERTs from the new code fail
+        # with "NOT NULL constraint failed: notification_tracker.batch_duration".
+        if await _has_table(conn, tracker_table):
+            if await _has_column(conn, tracker_table, "batch_duration"):
+                _assert_ident(tracker_table, "table")
+                await conn.execute(
+                    text(f"ALTER TABLE {tracker_table} DROP COLUMN batch_duration")
+                )
+                logger.info(
+                    "Dropped legacy batch_duration column from %s table",
+                    tracker_table,
+                )
+
         # Add Gitea tracking flags to tracking_config if missing
         if await _has_table(conn, "tracking_config"):
             gitea_flags = [

packages/server/src/notify_bridge_server/services/scheduler.py

@@ -378,6 +378,8 @@ async def _load_tracker_jobs() -> None:
 
     tz = await _load_app_timezone()
 
+    from notify_bridge_core.providers.capabilities import get_capabilities
+
     for tracker in trackers:
         job_id = f"tracker_{tracker.id}"
         if scheduler.get_job(job_id):
@@ -386,6 +388,18 @@ async def _load_tracker_jobs() -> None:
         ptype = provider_types.get(tracker.provider_id, "")
         filters = tracker.filters or {}
 
+        # Webhook-based providers receive events via inbound HTTP — there is
+        # nothing to poll. Scheduling an interval job for them just wakes up
+        # check_tracker every scan_interval seconds to immediately return,
+        # wasting CPU and DB queries for no work.
+        caps = get_capabilities(ptype) if ptype else None
+        if caps and caps.webhook_based:
+            _LOGGER.debug(
+                "Skipping interval scheduling for webhook tracker %d (%s, type=%s)",
+                tracker.id, tracker.name, ptype,
+            )
+            continue
+
         # Scheduler providers can use cron triggers
         if ptype == "scheduler" and filters.get("schedule_type") == "cron":
             cron_expr = filters.get("cron_expression", "")
@@ -450,6 +464,29 @@ def _add_cron_job(
     )
 
 
+async def _is_webhook_tracker(tracker_id: int) -> bool:
+    """Return True iff the tracker's provider type is webhook-based.
+
+    Looks up provider type once via the capabilities registry. Used by
+    ``schedule_tracker`` to short-circuit interval scheduling.
+    """
+    from sqlmodel import select
+    from sqlmodel.ext.asyncio.session import AsyncSession
+    from notify_bridge_core.providers.capabilities import get_capabilities
+    from ..database.engine import get_engine
+    from ..database.models import NotificationTracker, ServiceProvider as ServiceProviderModel
+
+    async with AsyncSession(get_engine()) as session:
+        tracker = await session.get(NotificationTracker, tracker_id)
+        if tracker is None:
+            return False
+        provider = await session.get(ServiceProviderModel, tracker.provider_id)
+        if provider is None:
+            return False
+        caps = get_capabilities(provider.type)
+        return bool(caps and caps.webhook_based)
+
+
 async def schedule_tracker(
     tracker_id: int,
     interval: int,
@@ -461,6 +498,10 @@ async def schedule_tracker(
     ``adaptive_max_skip`` mirrors the DB column and is registered with the
     adaptive module-state so tick-time skip decisions don't re-query the DB.
     Pass ``None`` or ``0`` to disable back-off for the tracker.
+
+    Webhook-based providers receive events via inbound HTTP and have nothing
+    to poll, so this no-ops for them — preventing scan_interval from creating
+    useless wakeups via the API create/update path.
     """
     scheduler = get_scheduler()
     job_id = f"tracker_{tracker_id}"
@@ -474,6 +515,13 @@ async def schedule_tracker(
     if scheduler.get_job(job_id):
         scheduler.remove_job(job_id)
 
+    # Webhook-based providers don't poll — skip job creation entirely.
+    if await _is_webhook_tracker(tracker_id):
+        _LOGGER.debug(
+            "Skipping interval scheduling for webhook tracker %d", tracker_id,
+        )
+        return
+
     if cron_expression:
         try:
             tz = await _load_app_timezone()