feat: comprehensive code review fixes — security, performance, quality

Backend security:
- Reject Gitea webhooks when webhook_secret is empty (was silently skipping)
- Add slowapi rate limiting on login (5/min) and setup (3/min) endpoints
- Add CORS middleware with configurable origins
- Mask telegram_webhook_secret in settings API response
- Protect system-owned command template configs from regular user modification
- Increase minimum password length to 8 characters

Backend performance:
- Batch queries in _resolve_command_context (3 queries instead of 3N)
- Concurrent album fetching with asyncio.gather in immich commands
- Singleton Jinja2 SandboxedEnvironment (reuse instead of per-render creation)
- TTLCache for rate limits (bounded memory, auto-eviction)
- Optional aiohttp session reuse in send_reply/send_media_group

Backend code quality:
- Extract dispatch_helpers.py (shared link_data loading + event filtering)
- Extract database/seeds.py from main.py (490 lines → dedicated module)
- Split immich_handler.py (415 lines) into commands/immich/ subpackage
- Replace bare except blocks with logged warnings
- Add per-provider config validation (Pydantic models)
- Truncate command input to 512 chars
- Expose usage_* and desc_* slots in capabilities and variables API

Frontend security:
- CSS.escape() for user-controlled querySelector in highlight.ts
- Client-side password min 8 chars validation on setup and password change

Frontend code quality:
- Replace any types with proper interfaces across top files
- Decompose targets/+page.svelte into TargetForm + ReceiverSection
- Fix $derived.by usage, $state mutation patterns
- Add console.warn to empty catch blocks

Frontend UX:
- Auth redirect via goto() with "Redirecting..." state
- Platform-aware Ctrl/Cmd K keyboard hint
- Remove stat-card hover transform

Frontend accessibility:
- Modal: role=dialog, aria-modal, focus trap, restore focus
- EntitySelect/IconGridSelect: listbox/option roles, aria-selected/disabled

frontend/src/lib/components/IconGridSelect.svelte

@@ -76,6 +76,8 @@
 <button type="button" bind:this={triggerEl} onclick={toggle}
 	class="icon-grid-trigger {compact ? 'icon-grid-compact' : ''}"
 	class:disabled
+	aria-expanded={open}
+	aria-haspopup="listbox"
 	style="opacity: {disabled ? 0.5 : 1}; cursor: {disabled ? 'default' : 'pointer'};">
 	{#if selected}
 		<span class="icon-grid-trigger-icon"><MdiIcon name={selected.icon} size={compact ? 14 : 18} /></span>
@@ -99,11 +101,13 @@
 				class="icon-grid-search" type="text" autocomplete="off"
 				onkeydown={handleKeydown} />
 		{/if}
-		<div class="icon-grid" style="grid-template-columns: repeat({columns}, 1fr);">
+		<div class="icon-grid" style="grid-template-columns: repeat({columns}, 1fr);" role="listbox">
 			{#each filtered as item}
 				<button type="button"
 					class="icon-grid-cell"
 					class:active={String(item.value) === String(value)}
+					role="option"
+					aria-selected={String(item.value) === String(value)}
 					onclick={() => select(item)}>
 					<span class="icon-grid-cell-icon"><MdiIcon name={item.icon} size={22} /></span>
 					<span class="icon-grid-cell-label">{item.label}</span>