feat: large polish pass — UX fixes, per-chat scope, restore/backup, action events

Backend
- Per-chat album scope for Immich commands (search/latest/memory/...): new
  allowed_album_ids on CommandTrackerListener, threaded listener/page kwargs
  through ProviderCommandHandler.handle; PATCH listener-scope endpoint.
- /search and /find accept a trailing page number; Immich client search_smart
  / search_metadata take a page param.
- Immich person-asset lookup switched from removed GET /api/people/{id}/assets
  to POST /api/search/metadata with personIds (fixes /person command and
  auto_organize rules silently returning zero candidates on Immich 1.106+).
- Auto_organize rule now sets the target album's thumbnail to the first added
  image when missing (falls back to any asset type); failures do not fail the
  rule. add_assets_to_album surfaces the Immich error body on non-2xx.
- EventLog.user_id / action_id / action_name columns with defensive migration
  + backfill. Status query filters by user_id directly; Immich/webhook paths
  emit user_id explicitly. action_runner writes an action_success/partial/
  failed event on each non-dry-run.
- Dashboard DELETE /api/status/events (scoped to user_id) + rendering live
  tracker/provider/action names via FK join with snapshot fallback.
- PATCH /api/users/{id} for username/role change with last-admin guard.
- Deletion protection returns structured {message, entity, blocked_by}
  (ApiError carries .blockedBy; frontend opens BlockedByModal).
- Backup prepare-restore → AppSetting markers + atomic write of
  pending_restore.json; lifespan hook applies on next startup and archives
  under data/applied_restores/. apply-restart sends SIGTERM so the lifespan
  shutdown runs; NOTIFY_BRIDGE_SUPERVISED env override gates the button.
  Manual POST /api/backup/files (same format as scheduled).
- New periodic-summary test path reuses shared collect_scheduled_assets
  (limit=0) so test and future production code go through one primitive.
- Per-receiver locale for Telegram test messages (resolves
  TelegramChat.language_override per chat instead of applying the first
  receiver's locale to everyone).
- Bounded concurrency (semaphores) in NotificationDispatcher._preload_asset_data
  and _refresh_telegram_chat_titles; chat title sweep extended to 24h since
  save_chat_from_webhook covers active chats opportunistically.
- Telegram poller detects the \"webhook is active\" 409 and auto-calls
  deleteWebhook for bots whose DB update_mode is polling (throttled per bot).
- TelegramClient.get_chat added (CLAUDE.md rule 6); set_album_thumbnail added.
- Seeds: rename \"Default Commands\" → \"Default Immich Commands\";
  track_assets_removed default False.

Frontend
- Global provider selector visible when there is only one provider.
- Clear-events button + i18n + ConfirmModal on the dashboard; new icons/
  labels/filters/colors for action_success / action_partial / action_failed.
- Auto-select first available tracking/template/command/config + bot on
  create forms (trackers, command-trackers, targets, template/command
  configs).
- Telegram target disable_url_preview defaults to true.
- BlockedByModal wired into 8 deletion flows; fetchAuth helper for
  multipart/binary calls (reuses api()'s refresh + ApiError mapping).
- Immich tracker 'Checking links' parallelised (concurrency cap 6).
- Backup page: pending-restore banner + Apply-now / Apply-later modal,
  restarting overlay polling /api/health, manual 'Create backup' button.
- Command-trackers listener row gets an 'Edit album scope' modal with
  inherit/explicit multiselect.
- Users page: Edit user modal (username + role).
- parseDate helper for consistent UTC date rendering.

Migrations / schema
- event_log: + user_id, action_id, action_name (+ backfill user_id from
  notification_tracker).
- command_tracker_listener: + allowed_album_ids.

packages/server/src/notify_bridge_server/services/telegram_poller.py

@@ -28,6 +28,16 @@ _LOGGER = logging.getLogger(__name__)
 # Track last update_id per bot to use as offset
 _last_update_id: dict[int, int] = {}
 
+# Throttle auto-reclaim attempts so we don't hammer deleteWebhook when a
+# stubborn external instance keeps re-setting the webhook.  (bot_id → unix ts)
+_last_webhook_reclaim_at: dict[int, float] = {}
+_WEBHOOK_RECLAIM_COOLDOWN_SECONDS = 60.0
+
+# Phrase Telegram uses in the 409 response description for the
+# "webhook is active" conflict.  Matched case-insensitively so we don't
+# depend on exact wording.
+_WEBHOOK_CONFLICT_PHRASE = "webhook is active"
+
 
 async def _get_bot_ids_with_active_listeners() -> set[int]:
     """Return bot IDs that have at least one active command tracker listener.
@@ -141,6 +151,64 @@ def unschedule_bot_polling(bot_id: int) -> None:
         _LOGGER.info("Stopped polling for bot %d", bot_id)
 
 
+async def _handle_webhook_conflict(bot_id: int, bot_token: str, description: str) -> None:
+    """Reclaim a bot stuck behind an active webhook set by another instance.
+
+    Telegram's ``getUpdates`` returns 409 ``Conflict: can't use getUpdates
+    method while webhook is active`` whenever a webhook is currently
+    registered for the bot.  Since this bot row has ``update_mode="polling"``
+    in our DB (that's the only reason we're polling it), the user's intent
+    is polling, so we drop the webhook and resume.  Throttled to once per
+    minute per bot so a rival instance constantly re-registering the
+    webhook doesn't trigger a reclaim storm.
+    """
+    import time
+    now = time.time()
+    last = _last_webhook_reclaim_at.get(bot_id, 0.0)
+    if now - last < _WEBHOOK_RECLAIM_COOLDOWN_SECONDS:
+        # Already logged recently; stay quiet until cooldown expires so the
+        # user gets one clear warning line per minute, not one every 3s.
+        return
+    _last_webhook_reclaim_at[bot_id] = now
+
+    from .http_session import get_http_session
+    http = await get_http_session()
+    client = TelegramClient(http, bot_token)
+
+    # Surface which URL stole the bot so the user can tell where it came from.
+    conflicting_url = ""
+    try:
+        info = await client.get_webhook_info()
+        if info.get("success"):
+            conflicting_url = info.get("result", {}).get("url", "") or ""
+    except Exception as err:  # noqa: BLE001
+        _LOGGER.debug("getWebhookInfo during conflict recovery failed: %s", err)
+
+    _LOGGER.warning(
+        "Bot %d: webhook is active (url=%r) but this instance is in polling "
+        "mode — calling deleteWebhook to reclaim. Telegram said: %s",
+        bot_id, conflicting_url, description,
+    )
+
+    try:
+        del_result = await client.delete_webhook()
+        if del_result.get("success"):
+            _LOGGER.warning(
+                "Bot %d: webhook cleared; polling will resume on next tick",
+                bot_id,
+            )
+            # Reset offset so we don't skip updates that accumulated during the
+            # conflict window (Telegram held them until a client acknowledged).
+            _last_update_id.pop(bot_id, None)
+        else:
+            _LOGGER.error(
+                "Bot %d: deleteWebhook failed: %s",
+                bot_id, del_result.get("error"),
+            )
+    except Exception as err:  # noqa: BLE001
+        _LOGGER.error("Bot %d: deleteWebhook raised: %s", bot_id, err)
+
+
 async def _poll_bot(bot_id: int) -> None:
     """Fetch updates from Telegram and process them."""
     engine = get_engine()
@@ -167,6 +235,15 @@ async def _poll_bot(bot_id: int) -> None:
             offset=offset + 1 if offset else None, limit=50,
         )
         if not result.get("success"):
+            err_text = str(result.get("error") or "")
+            # Detect the webhook-is-active conflict: another instance (or a
+            # stale registration) owns this bot's delivery, so getUpdates
+            # returns 409 and we get zero updates forever.  Reclaim it —
+            # but only for bots the user explicitly set to polling mode.
+            if _WEBHOOK_CONFLICT_PHRASE in err_text.lower():
+                await _handle_webhook_conflict(bot_id, bot_token, err_text)
+            else:
+                _LOGGER.debug("Polling error for bot %d: %s", bot_id, err_text)
             return
         updates = result.get("result", [])
     except Exception as e: