fix: comprehensive API/UI review — 26 bug fixes and improvements

Backend:
- Scheduler lifecycle sync: create/update/delete tracker now syncs APScheduler jobs
- Test-periodic/test-memory endpoints render actual Jinja2 templates with sample data
- Cascade cleanup on tracker delete (TrackerState removed, EventLog nullified)
- Fix user_id=0 FK violation for system-owned TemplateConfig (removed FK constraint)
- Fix API key leak: only attach x-api-key header for internal provider URLs
- Validate config ownership in tracker_targets create/update
- Fix _response() double-emit of created_at in template/tracking configs
- Add per-target-link test endpoints (test, test-periodic, test-memory)

Frontend:
- Fix orphaned provider on test exception in providers/new
- Add submitting guard + disabled state to targets save button
- Move test buttons from tracker card to per-target-link rows
- Fix Svelte 5 async $state reactivity (spread reassignment for all Record mutations)
- i18n for dashboard timeAgo and event type badges (EN + RU)
- Add required attribute to chat select dropdown in targets
- Fix font CSS vars to prioritize imported DM Sans / JetBrains Mono
- Standardize empty states with centered icon + text across all 6 list pages
- Add stagger-children animation class to all list containers
- Fix slide transition duration consistency (200ms everywhere)
- Standardize border-radius to rounded-md across all form inputs
- Fix providers/new page structure (h2 + mb-8 spacing)
- Fix tracker card action row overflow (flex-wrap justify-end)
- JinjaEditor dark mode reactivity (recreate editor on theme change)
- Add aria-labels to mobile nav items
- Make ConfirmModal confirm button label/icon configurable
- Remove double error reporting on providers page
- Add telegram bot edit functionality (name editing via PUT)
- i18n for External Domain label on provider forms

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/core/src/notify_bridge_core/notifications/dispatcher.py

@@ -30,6 +30,8 @@ class TargetConfig:
     type: str  # "telegram" or "webhook"
     config: dict[str, Any]  # type-specific config
     template_slots: dict[str, str] | None = None  # event_type -> template string
+    provider_api_key: str | None = None  # API key for downloading assets from provider
+    provider_internal_url: str | None = None  # Internal provider URL for API key scoping
 
 
 class NotificationDispatcher:
@@ -88,12 +90,18 @@ class NotificationDispatcher:
             client = TelegramClient(session, bot_token)
 
             # Build asset list for media sending
+            # Only attach API key header for URLs pointing to the internal provider
+            internal_url = target.provider_internal_url or ""
             assets = []
             for asset in event.added_assets:
                 url = asset.full_url or asset.thumbnail_url
                 if url:
                     asset_type = "video" if asset.type.value == "video" else "photo"
-                    assets.append({"url": url, "type": asset_type})
+                    # Include API key only for internal provider URLs
+                    asset_headers = {}
+                    if target.provider_api_key and internal_url and url.startswith(internal_url):
+                        asset_headers["x-api-key"] = target.provider_api_key
+                    assets.append({"url": url, "type": asset_type, "headers": asset_headers})
 
             return await client.send_notification(
                 chat_id=str(chat_id),