feat: large polish pass — UX fixes, per-chat scope, restore/backup, action events

Backend
- Per-chat album scope for Immich commands (search/latest/memory/...): new
  allowed_album_ids on CommandTrackerListener, threaded listener/page kwargs
  through ProviderCommandHandler.handle; PATCH listener-scope endpoint.
- /search and /find accept a trailing page number; Immich client search_smart
  / search_metadata take a page param.
- Immich person-asset lookup switched from removed GET /api/people/{id}/assets
  to POST /api/search/metadata with personIds (fixes /person command and
  auto_organize rules silently returning zero candidates on Immich 1.106+).
- Auto_organize rule now sets the target album's thumbnail to the first added
  image when missing (falls back to any asset type); failures do not fail the
  rule. add_assets_to_album surfaces the Immich error body on non-2xx.
- EventLog.user_id / action_id / action_name columns with defensive migration
  + backfill. Status query filters by user_id directly; Immich/webhook paths
  emit user_id explicitly. action_runner writes an action_success/partial/
  failed event on each non-dry-run.
- Dashboard DELETE /api/status/events (scoped to user_id) + rendering live
  tracker/provider/action names via FK join with snapshot fallback.
- PATCH /api/users/{id} for username/role change with last-admin guard.
- Deletion protection returns structured {message, entity, blocked_by}
  (ApiError carries .blockedBy; frontend opens BlockedByModal).
- Backup prepare-restore → AppSetting markers + atomic write of
  pending_restore.json; lifespan hook applies on next startup and archives
  under data/applied_restores/. apply-restart sends SIGTERM so the lifespan
  shutdown runs; NOTIFY_BRIDGE_SUPERVISED env override gates the button.
  Manual POST /api/backup/files (same format as scheduled).
- New periodic-summary test path reuses shared collect_scheduled_assets
  (limit=0) so test and future production code go through one primitive.
- Per-receiver locale for Telegram test messages (resolves
  TelegramChat.language_override per chat instead of applying the first
  receiver's locale to everyone).
- Bounded concurrency (semaphores) in NotificationDispatcher._preload_asset_data
  and _refresh_telegram_chat_titles; chat title sweep extended to 24h since
  save_chat_from_webhook covers active chats opportunistically.
- Telegram poller detects the \"webhook is active\" 409 and auto-calls
  deleteWebhook for bots whose DB update_mode is polling (throttled per bot).
- TelegramClient.get_chat added (CLAUDE.md rule 6); set_album_thumbnail added.
- Seeds: rename \"Default Commands\" → \"Default Immich Commands\";
  track_assets_removed default False.

Frontend
- Global provider selector visible when there is only one provider.
- Clear-events button + i18n + ConfirmModal on the dashboard; new icons/
  labels/filters/colors for action_success / action_partial / action_failed.
- Auto-select first available tracking/template/command/config + bot on
  create forms (trackers, command-trackers, targets, template/command
  configs).
- Telegram target disable_url_preview defaults to true.
- BlockedByModal wired into 8 deletion flows; fetchAuth helper for
  multipart/binary calls (reuses api()'s refresh + ApiError mapping).
- Immich tracker 'Checking links' parallelised (concurrency cap 6).
- Backup page: pending-restore banner + Apply-now / Apply-later modal,
  restarting overlay polling /api/health, manual 'Create backup' button.
- Command-trackers listener row gets an 'Edit album scope' modal with
  inherit/explicit multiselect.
- Users page: Edit user modal (username + role).
- parseDate helper for consistent UTC date rendering.

Migrations / schema
- event_log: + user_id, action_id, action_name (+ backfill user_id from
  notification_tracker).
- command_tracker_listener: + allowed_album_ids.

packages/server/src/notify_bridge_server/commands/base.py

@@ -6,7 +6,10 @@ from abc import ABC, abstractmethod
 from dataclasses import dataclass, field
 from typing import Any
 
-from ..database.models import CommandConfig, CommandTracker, ServiceProvider, TelegramBot
+from ..database.models import (
+    CommandConfig, CommandTracker, CommandTrackerListener,
+    ServiceProvider, TelegramBot,
+)
 
 
 @dataclass(frozen=True)
@@ -51,6 +54,9 @@ class ProviderCommandHandler(ABC):
         bot: TelegramBot,
         tracker: CommandTracker,
         config: CommandConfig,
+        *,
+        listener: CommandTrackerListener | None = None,
+        page: int = 1,
     ) -> CommandResponse | None:
         """Handle a provider-specific command for a single tracker.
 

packages/server/src/notify_bridge_server/commands/gitea_handler.py

@@ -77,6 +77,9 @@ class GiteaCommandHandler(ProviderCommandHandler):
         bot: TelegramBot,
         tracker: CommandTracker,
         config: CommandConfig,
+        *,
+        listener: Any = None,
+        page: int = 1,
     ) -> CommandResponse | None:
         fn = _TEXT_COMMANDS.get(cmd)
         if fn is None:

packages/server/src/notify_bridge_server/commands/handler.py

@@ -95,7 +95,7 @@ def _render_cmd_template(
 async def _resolve_command_context(
     bot: TelegramBot,
 ) -> tuple[
-    list[tuple[CommandTracker, CommandConfig, ServiceProvider]],
+    list[tuple[CommandTracker, CommandConfig, ServiceProvider, CommandTrackerListener]],
     dict[int, dict[str, dict[str, str]]],
 ]:
     """Resolve all enabled command trackers, configs, and providers for a bot.
@@ -148,7 +148,7 @@ async def _resolve_command_context(
         else:
             providers_by_id = {}
 
-        tuples: list[tuple[CommandTracker, CommandConfig, ServiceProvider]] = []
+        tuples: list[tuple[CommandTracker, CommandConfig, ServiceProvider, CommandTrackerListener]] = []
         for listener in listeners:
             tracker = trackers_by_id.get(listener.command_tracker_id)
             if not tracker or not tracker.enabled:
@@ -159,12 +159,12 @@ async def _resolve_command_context(
             provider = providers_by_id.get(tracker.provider_id)
             if not provider:
                 continue
-            tuples.append((tracker, config, provider))
+            tuples.append((tracker, config, provider, listener))
 
         # Load command template slots per config (not merged)
         templates_by_config_id: dict[int, dict[str, dict[str, str]]] = {}
         seen_config_ids: set[int] = set()
-        for _, config, _ in tuples:
+        for _, config, _, _ in tuples:
             cfg_id = config.command_template_config_id
             if cfg_id and cfg_id not in seen_config_ids:
                 seen_config_ids.add(cfg_id)
@@ -204,7 +204,7 @@ def _merge_all_templates(
 
 
 def _merge_enabled_commands(
-    ctx: list[tuple[CommandTracker, CommandConfig, ServiceProvider]],
+    ctx: list[tuple[CommandTracker, CommandConfig, ServiceProvider, CommandTrackerListener]],
 ) -> tuple[list[str], dict[str, Any]]:
     """Merge enabled_commands (union) and rate_limits from all configs.
 
@@ -215,7 +215,7 @@ def _merge_enabled_commands(
 
     enabled: set[str] = set()
     merged_limits: dict[str, int] = {}
-    for _, config, _ in ctx:
+    for _, config, _, _ in ctx:
         enabled.update(config.enabled_commands or [])
         for category, cooldown in (config.rate_limits or {}).items():
             if category not in merged_limits:
@@ -278,8 +278,16 @@ async def handle_command(
     # Provider-specific dispatch — per-tracker
     from .dispatch import get_handler
 
+    # For paginated commands (/search, /find) a trailing integer means page,
+    # not count. Preserve count_override meaning for all other commands.
+    paginated_cmds = {"search", "find"}
+    page = 1
+    if cmd in paginated_cmds and count_override:
+        page = max(1, count_override)
+        count_override = None
+
     responses: list[CommandResponse] = []
-    for tracker, config, provider in ctx_tuples:
+    for tracker, config, provider, listener in ctx_tuples:
         if len(responses) >= _MAX_RESPONSES_PER_COMMAND:
             _LOGGER.warning(
                 "Truncated command responses at %d for bot %d cmd /%s",
@@ -298,6 +306,7 @@ async def handle_command(
         result = await handler.handle(
             cmd, args, count, locale, response_mode,
             provider, tracker_templates, bot, tracker, config,
+            listener=listener, page=page,
         )
         if result is not None:
             responses.append(result)

packages/server/src/notify_bridge_server/commands/immich/handler.py

@@ -6,7 +6,7 @@ import logging
 from typing import Any
 
 from ...database.models import (
-    CommandConfig, CommandTracker,
+    CommandConfig, CommandTracker, CommandTrackerListener,
     ServiceProvider, TelegramBot,
 )
 from ...services import make_immich_provider
@@ -78,6 +78,9 @@ class ImmichCommandHandler(ProviderCommandHandler):
         bot: TelegramBot,
         tracker: CommandTracker,
         config: CommandConfig,
+        *,
+        listener: CommandTrackerListener | None = None,
+        page: int = 1,
     ) -> CommandResponse | None:
         if cmd == "status":
             ctx = await _cmd_status(provider, locale)
@@ -96,6 +99,7 @@ class ImmichCommandHandler(ProviderCommandHandler):
             return await _cmd_immich(
                 cmd, args, count, locale, response_mode,
                 provider, cmd_templates,
+                listener=listener, page=page,
             )
         return None
 
@@ -104,13 +108,25 @@ async def _cmd_immich(
     cmd: str, args: str, count: int, locale: str,
     response_mode: str, provider: ServiceProvider,
     cmd_templates: dict[str, dict[str, str]],
+    *,
+    listener: CommandTrackerListener | None = None,
+    page: int = 1,
 ) -> CommandResponse | None:
     """Handle commands that need Immich API access and may return media."""
     notification_trackers = await get_trackers_for_provider(provider.id)
 
     all_album_ids: list[str] = []
+    seen: set[str] = set()
     for t in notification_trackers:
-        all_album_ids.extend(t.collection_ids or [])
+        for aid in (t.collection_ids or []):
+            if aid not in seen:
+                seen.add(aid)
+                all_album_ids.append(aid)
+
+    # Per-chat album scope: intersect with listener.allowed_album_ids when set.
+    if listener is not None and listener.allowed_album_ids is not None:
+        allowed = set(listener.allowed_album_ids)
+        all_album_ids = [aid for aid in all_album_ids if aid in allowed]
 
     ext_domain = (provider.config.get("external_domain") or provider.config.get("url", "")).rstrip("/")
 
@@ -135,9 +151,9 @@ async def _cmd_immich(
     result: str | dict[str, Any] | None = None
 
     if cmd == "search":
-        result = await cmd_search(client, args, all_album_ids, count, locale, response_mode, cmd_templates, asset_public_urls=asset_public_urls)
+        result = await cmd_search(client, args, all_album_ids, count, locale, response_mode, cmd_templates, asset_public_urls=asset_public_urls, page=page)
     elif cmd == "find":
-        result = await cmd_find(client, args, all_album_ids, count, locale, response_mode, cmd_templates, asset_public_urls=asset_public_urls)
+        result = await cmd_find(client, args, all_album_ids, count, locale, response_mode, cmd_templates, asset_public_urls=asset_public_urls, page=page)
     elif cmd == "person":
         result = await cmd_person(client, args, count, locale, response_mode, cmd_templates, asset_public_urls=asset_public_urls)
     elif cmd == "place":

packages/server/src/notify_bridge_server/commands/immich/search.py

@@ -25,11 +25,12 @@ async def cmd_search(
     locale: str, response_mode: str,
     cmd_templates: dict[str, dict[str, str]],
     asset_public_urls: dict[str, str] | None = None,
+    page: int = 1,
 ) -> str | dict[str, Any]:
     """Handle /search command."""
     if not args:
         return _render_cmd_template(cmd_templates, "no_results", locale, {"command": "search", "query": ""})
-    assets = await client.search_smart(args, album_ids=all_album_ids, limit=count)
+    assets = await client.search_smart(args, album_ids=all_album_ids, limit=count, page=page)
     _enrich_assets(assets, asset_public_urls or {})
     return _format_assets(assets, "search", args, locale, response_mode, client, cmd_templates)
 
@@ -39,11 +40,12 @@ async def cmd_find(
     locale: str, response_mode: str,
     cmd_templates: dict[str, dict[str, str]],
     asset_public_urls: dict[str, str] | None = None,
+    page: int = 1,
 ) -> str | dict[str, Any]:
     """Handle /find command."""
     if not args:
         return _render_cmd_template(cmd_templates, "no_results", locale, {"command": "find", "query": ""})
-    assets = await client.search_metadata(args, album_ids=all_album_ids, limit=count)
+    assets = await client.search_metadata(args, album_ids=all_album_ids, limit=count, page=page)
     _enrich_assets(assets, asset_public_urls or {})
     return _format_assets(assets, "find", args, locale, response_mode, client, cmd_templates)
 

packages/server/src/notify_bridge_server/commands/nut_handler.py

@@ -52,6 +52,9 @@ class NutCommandHandler(ProviderCommandHandler):
         bot: TelegramBot,
         tracker: CommandTracker,
         config: CommandConfig,
+        *,
+        listener: Any = None,
+        page: int = 1,
     ) -> CommandResponse | None:
         fn = _TEXT_COMMANDS.get(cmd)
         if fn is None:

packages/server/src/notify_bridge_server/commands/planka_handler.py

@@ -69,6 +69,9 @@ class PlankaCommandHandler(ProviderCommandHandler):
         bot: TelegramBot,
         tracker: CommandTracker,
         config: CommandConfig,
+        *,
+        listener: Any = None,
+        page: int = 1,
     ) -> CommandResponse | None:
         fn = _TEXT_COMMANDS.get(cmd)
         if fn is None: