feat: comprehensive code review fixes — security, performance, quality

Backend security:
- Reject Gitea webhooks when webhook_secret is empty (was silently skipping)
- Add slowapi rate limiting on login (5/min) and setup (3/min) endpoints
- Add CORS middleware with configurable origins
- Mask telegram_webhook_secret in settings API response
- Protect system-owned command template configs from regular user modification
- Increase minimum password length to 8 characters

Backend performance:
- Batch queries in _resolve_command_context (3 queries instead of 3N)
- Concurrent album fetching with asyncio.gather in immich commands
- Singleton Jinja2 SandboxedEnvironment (reuse instead of per-render creation)
- TTLCache for rate limits (bounded memory, auto-eviction)
- Optional aiohttp session reuse in send_reply/send_media_group

Backend code quality:
- Extract dispatch_helpers.py (shared link_data loading + event filtering)
- Extract database/seeds.py from main.py (490 lines → dedicated module)
- Split immich_handler.py (415 lines) into commands/immich/ subpackage
- Replace bare except blocks with logged warnings
- Add per-provider config validation (Pydantic models)
- Truncate command input to 512 chars
- Expose usage_* and desc_* slots in capabilities and variables API

Frontend security:
- CSS.escape() for user-controlled querySelector in highlight.ts
- Client-side password min 8 chars validation on setup and password change

Frontend code quality:
- Replace any types with proper interfaces across top files
- Decompose targets/+page.svelte into TargetForm + ReceiverSection
- Fix $derived.by usage, $state mutation patterns
- Add console.warn to empty catch blocks

Frontend UX:
- Auth redirect via goto() with "Redirecting..." state
- Platform-aware Ctrl/Cmd K keyboard hint
- Remove stat-card hover transform

Frontend accessibility:
- Modal: role=dialog, aria-modal, focus trap, restore focus
- EntitySelect/IconGridSelect: listbox/option roles, aria-selected/disabled

frontend/src/routes/+page.svelte

@@ -12,13 +12,14 @@
 	import EntitySelect from '$lib/components/EntitySelect.svelte';
 	import { eventTypeFilterItems, sortFilterItems } from '$lib/grid-items';
 
-	let status = $state<any>(null);
+	import type { DashboardStatus } from '$lib/types';
+	let status = $state<DashboardStatus | null>(null);
 	let providers = $derived(providersCache.items);
 	const providerFilterItems = $derived([
 		{ value: '', label: t('dashboard.allProviders'), icon: 'mdiFilterOff' },
 		...providers.map(p => ({ value: p.id, label: p.name, icon: p.icon || 'mdiServer', desc: p.type })),
 	]);
-	let chartDays = $state<any[]>([]);
+	let chartDays = $state<{ date: string; [eventType: string]: string | number }[]>([]);
 	let loaded = $state(false);
 	let error = $state('');
 
@@ -78,7 +79,7 @@
 			params.set('limit', String(eventsLimit));
 			params.set('offset', String(eventsOffset));
 			const qs = params.toString();
-			status = await api<any>(`/status${qs ? '?' + qs : ''}`);
+			status = await api<DashboardStatus>(`/status${qs ? '?' + qs : ''}`);
 		} catch (err: any) {
 			error = err.message || t('common.error');
 		} finally {
@@ -90,9 +91,9 @@
 		try {
 			const params = buildFilterParams();
 			const qs = params.toString();
-			const chartRes = await api<any>(`/status/chart${qs ? '?' + qs : ''}`);
+			const chartRes = await api<{ days: { date: string; [k: string]: string | number }[] }>(`/status/chart${qs ? '?' + qs : ''}`);
 			chartDays = chartRes.days || [];
-		} catch {}
+		} catch (e) { console.warn('Failed to load chart data:', e); }
 	}
 
 	// Auto-apply when filter values change (via IconGridSelect bind:value)
@@ -149,13 +150,14 @@
 	async function loadInitial() {
 		try {
 			const [statusRes, , chartRes] = await Promise.all([
-				api<any>(`/status?limit=${eventsLimit}`),
+				api<DashboardStatus>(`/status?limit=${eventsLimit}`),
 				providersCache.fetch(),
-				api<any>('/status/chart'),
+				api<{ days: { date: string; [k: string]: string | number }[] }>('/status/chart'),
 			]);
 			status = statusRes;
 			chartDays = chartRes.days || [];
 			setTimeout(() => {
+				if (!status) return;
 				animateCount(0, status.providers, (v) => displayProviders = v);
 				animateCount(0, status.trackers.active, (v) => displayActive = v);
 				animateCount(0, status.trackers.total, (v) => displayTotal = v);
@@ -339,7 +341,7 @@
 
 <style>
 	.stat-card { position: relative; border-radius: 0.75rem; padding: 1px; background: linear-gradient(135deg, var(--accent), transparent 60%, var(--color-border)); transition: all 0.3s ease; }
-	.stat-card:hover { box-shadow: 0 0 24px color-mix(in srgb, var(--accent) 20%, transparent); transform: translateY(-2px); }
+	.stat-card:hover { box-shadow: 0 0 24px color-mix(in srgb, var(--accent) 20%, transparent); }
 	.stat-card-inner { background: var(--color-card); border-radius: calc(0.75rem - 1px); padding: 1.25rem; }
 	.stat-icon { display: flex; align-items: center; justify-content: center; width: 2.75rem; height: 2.75rem; border-radius: 0.75rem; flex-shrink: 0; }
 	.stat-value { font-size: 1.75rem; font-weight: 600; line-height: 1.2; animation: countUp 0.5s ease-out both; }