feat: UX improvements — secure webhooks, locale fixes, dynamic languages, UI polish

- Remove top paginator from dashboard events, keep only bottom
- Fix test message locale: pass UI locale to email/matrix bot tests
- Convert webhook auth mode from text input to icon grid selector
- Generate secure UUID tokens for webhook URLs instead of sequential IDs
- Move Recent Payloads into per-provider expandable container (lazy-loaded)
- Make template config languages dynamic via app settings instead of hardcoded
- Change default dev port to 5175

packages/server/src/notify_bridge_server/database/migrations.py

@@ -272,6 +272,24 @@ async def migrate_schema(engine: AsyncEngine) -> None:
                 )
                 logger.info("Added commands_enabled column to telegram_chat table")
 
+        # Add webhook_token to service_provider if missing
+        if await _has_table(conn, "service_provider"):
+            if not await _has_column(conn, "service_provider", "webhook_token"):
+                await conn.execute(
+                    text("ALTER TABLE service_provider ADD COLUMN webhook_token TEXT DEFAULT ''")
+                )
+                logger.info("Added webhook_token column to service_provider table")
+                # Backfill existing providers with unique tokens
+                import uuid
+                providers = (await conn.execute(text("SELECT id FROM service_provider"))).fetchall()
+                for row in providers:
+                    await conn.execute(
+                        text("UPDATE service_provider SET webhook_token = :tok WHERE id = :pid"),
+                        {"tok": uuid.uuid4().hex, "pid": row[0]},
+                    )
+                if providers:
+                    logger.info("Backfilled webhook_token for %d existing providers", len(providers))
+
 
 # ---------------------------------------------------------------------------
 # Legacy tracker_target migration (pre-Phase 1)