feat(notify-bridge): phase 6 - database models and server API

New database schema with ServiceProvider abstraction:
- ServiceProvider (replaces ImmichServer): type + JSON config
- Tracker (replaces AlbumTracker): owns tracking_config_id
- TrackingConfig: provider_type scoped, owned by Tracker
- TemplateConfig: provider_type scoped, owned by Target
- NotificationTarget: owns template_config_id (not tracking_config_id)
- TrackerState, EventLog, User, TelegramBot, TelegramChat

Full FastAPI server:
- /api/providers: CRUD + test connection + list collections
- /api/trackers: CRUD
- /api/tracking-configs: CRUD with provider_type filter
- /api/template-configs: CRUD with provider_type filter, system defaults
- /api/targets: CRUD
- /api/template-vars: variable docs filtered by provider type
- /api/auth: setup, login, refresh, me, password change
- /api/health: health check
- Default template seeding on first startup (EN/RU for Immich)
- pydantic-settings with NOTIFY_BRIDGE_ env prefix

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/server/src/notify_bridge_server/config.py

@@ -1,12 +1,47 @@
-"""Server configuration — settings, data directory, secrets."""
+"""Server configuration from environment variables."""
 
-import os
 from pathlib import Path
+from typing import Any
+from pydantic_settings import BaseSettings
 
 
-DATA_DIR = Path(os.environ.get("NOTIFY_BRIDGE_DATA_DIR", "./data"))
-SECRET_KEY = os.environ.get("NOTIFY_BRIDGE_SECRET_KEY", "")
-DATABASE_URL = os.environ.get(
-    "NOTIFY_BRIDGE_DATABASE_URL",
-    f"sqlite+aiosqlite:///{DATA_DIR / 'notify_bridge.db'}",
-)
+class Settings(BaseSettings):
+    """Application settings loaded from environment variables."""
+
+    data_dir: Path = Path("/data")
+    database_url: str = ""
+
+    secret_key: str = "change-me-in-production"
+
+    def model_post_init(self, __context: Any) -> None:
+        if self.secret_key == "change-me-in-production" and not self.debug:
+            import logging
+            logging.getLogger(__name__).critical(
+                "SECURITY: Using default secret_key! "
+                "Set NOTIFY_BRIDGE_SECRET_KEY environment variable."
+            )
+
+    access_token_expire_minutes: int = 60
+    refresh_token_expire_days: int = 30
+
+    host: str = "0.0.0.0"
+    port: int = 8420
+    debug: bool = False
+
+    anthropic_api_key: str = ""
+    ai_model: str = "claude-sonnet-4-20250514"
+    ai_max_tokens: int = 1024
+
+    telegram_webhook_secret: str = ""
+
+    model_config = {"env_prefix": "NOTIFY_BRIDGE_"}
+
+    @property
+    def effective_database_url(self) -> str:
+        if self.database_url:
+            return self.database_url
+        db_path = self.data_dir / "notify_bridge.db"
+        return f"sqlite+aiosqlite:///{db_path}"
+
+
+settings = Settings()