feat: comprehensive code review fixes — security, performance, quality

Backend security:
- Reject Gitea webhooks when webhook_secret is empty (was silently skipping)
- Add slowapi rate limiting on login (5/min) and setup (3/min) endpoints
- Add CORS middleware with configurable origins
- Mask telegram_webhook_secret in settings API response
- Protect system-owned command template configs from regular user modification
- Increase minimum password length to 8 characters

Backend performance:
- Batch queries in _resolve_command_context (3 queries instead of 3N)
- Concurrent album fetching with asyncio.gather in immich commands
- Singleton Jinja2 SandboxedEnvironment (reuse instead of per-render creation)
- TTLCache for rate limits (bounded memory, auto-eviction)
- Optional aiohttp session reuse in send_reply/send_media_group

Backend code quality:
- Extract dispatch_helpers.py (shared link_data loading + event filtering)
- Extract database/seeds.py from main.py (490 lines → dedicated module)
- Split immich_handler.py (415 lines) into commands/immich/ subpackage
- Replace bare except blocks with logged warnings
- Add per-provider config validation (Pydantic models)
- Truncate command input to 512 chars
- Expose usage_* and desc_* slots in capabilities and variables API

Frontend security:
- CSS.escape() for user-controlled querySelector in highlight.ts
- Client-side password min 8 chars validation on setup and password change

Frontend code quality:
- Replace any types with proper interfaces across top files
- Decompose targets/+page.svelte into TargetForm + ReceiverSection
- Fix $derived.by usage, $state mutation patterns
- Add console.warn to empty catch blocks

Frontend UX:
- Auth redirect via goto() with "Redirecting..." state
- Platform-aware Ctrl/Cmd K keyboard hint
- Remove stat-card hover transform

Frontend accessibility:
- Modal: role=dialog, aria-modal, focus trap, restore focus
- EntitySelect/IconGridSelect: listbox/option roles, aria-selected/disabled

packages/server/src/notify_bridge_server/auth/routes.py

@@ -1,7 +1,9 @@
 """Authentication API routes."""
 
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, Request, status
 from pydantic import BaseModel
+from slowapi import Limiter
+from slowapi.util import get_remote_address
 from sqlmodel import func, select
 from sqlmodel.ext.asyncio.session import AsyncSession
 
@@ -14,6 +16,8 @@ from .jwt import create_access_token, create_refresh_token, decode_token
 
 router = APIRouter(prefix="/api/auth", tags=["auth"])
 
+limiter = Limiter(key_func=get_remote_address)
+
 
 class SetupRequest(BaseModel):
     username: str
@@ -50,14 +54,15 @@ def _verify_password(password: str, hashed: str) -> bool:
 
 
 @router.post("/setup", response_model=TokenResponse)
-async def setup(body: SetupRequest, session: AsyncSession = Depends(get_session)):
+@limiter.limit("3/minute")
+async def setup(request: Request, body: SetupRequest, session: AsyncSession = Depends(get_session)):
     result = await session.exec(select(func.count()).select_from(User))
     count = result.one()
     if count > 0:
         raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Setup already completed.")
 
-    if len(body.password) < 6:
-        raise HTTPException(status_code=400, detail="Password must be at least 6 characters")
+    if len(body.password) < 8:
+        raise HTTPException(status_code=400, detail="Password must be at least 8 characters")
     user = User(username=body.username, hashed_password=_hash_password(body.password), role="admin")
     session.add(user)
     await session.commit()
@@ -70,7 +75,8 @@ async def setup(body: SetupRequest, session: AsyncSession = Depends(get_session)
 
 
 @router.post("/login", response_model=TokenResponse)
-async def login(body: LoginRequest, session: AsyncSession = Depends(get_session)):
+@limiter.limit("5/minute")
+async def login(request: Request, body: LoginRequest, session: AsyncSession = Depends(get_session)):
     result = await session.exec(select(User).where(User.username == body.username))
     user = result.first()
     if not user or not _verify_password(body.password, user.hashed_password):
@@ -121,8 +127,8 @@ async def change_password(
 ):
     if not _verify_password(body.current_password, user.hashed_password):
         raise HTTPException(status_code=400, detail="Current password is incorrect")
-    if len(body.new_password) < 6:
-        raise HTTPException(status_code=400, detail="New password must be at least 6 characters")
+    if len(body.new_password) < 8:
+        raise HTTPException(status_code=400, detail="New password must be at least 8 characters")
     user.hashed_password = _hash_password(body.new_password)
     session.add(user)
     await session.commit()