feat: comprehensive code review fixes — security, performance, quality

Backend security:
- Reject Gitea webhooks when webhook_secret is empty (was silently skipping)
- Add slowapi rate limiting on login (5/min) and setup (3/min) endpoints
- Add CORS middleware with configurable origins
- Mask telegram_webhook_secret in settings API response
- Protect system-owned command template configs from regular user modification
- Increase minimum password length to 8 characters

Backend performance:
- Batch queries in _resolve_command_context (3 queries instead of 3N)
- Concurrent album fetching with asyncio.gather in immich commands
- Singleton Jinja2 SandboxedEnvironment (reuse instead of per-render creation)
- TTLCache for rate limits (bounded memory, auto-eviction)
- Optional aiohttp session reuse in send_reply/send_media_group

Backend code quality:
- Extract dispatch_helpers.py (shared link_data loading + event filtering)
- Extract database/seeds.py from main.py (490 lines → dedicated module)
- Split immich_handler.py (415 lines) into commands/immich/ subpackage
- Replace bare except blocks with logged warnings
- Add per-provider config validation (Pydantic models)
- Truncate command input to 512 chars
- Expose usage_* and desc_* slots in capabilities and variables API

Frontend security:
- CSS.escape() for user-controlled querySelector in highlight.ts
- Client-side password min 8 chars validation on setup and password change

Frontend code quality:
- Replace any types with proper interfaces across top files
- Decompose targets/+page.svelte into TargetForm + ReceiverSection
- Fix $derived.by usage, $state mutation patterns
- Add console.warn to empty catch blocks

Frontend UX:
- Auth redirect via goto() with "Redirecting..." state
- Platform-aware Ctrl/Cmd K keyboard hint
- Remove stat-card hover transform

Frontend accessibility:
- Modal: role=dialog, aria-modal, focus trap, restore focus
- EntitySelect/IconGridSelect: listbox/option roles, aria-selected/disabled

packages/server/src/notify_bridge_server/services/watcher.py

@@ -3,7 +3,6 @@
 from __future__ import annotations
 
 import logging
-from datetime import datetime, time, timezone
 from typing import Any
 
 import aiohttp
@@ -17,19 +16,12 @@ from notify_bridge_core.storage import JsonFileBackend
 
 from ..database.engine import get_engine
 from ..database.models import (
-    EmailBot,
     EventLog,
-    MatrixBot,
-    NotificationTarget,
     NotificationTracker,
     NotificationTrackerState,
-    NotificationTrackerTarget,
     ServiceProvider,
-    TargetReceiver,
-    TemplateConfig,
-    TemplateSlot,
-    TrackingConfig,
 )
+from .dispatch_helpers import event_allowed_by_config, load_link_data
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -57,49 +49,6 @@ async def _get_telegram_caches() -> tuple[TelegramFileCache | None, TelegramFile
     return _url_cache, _asset_cache
 
 
-def _in_quiet_hours(start: str | None, end: str | None) -> bool:
-    """Check if the current UTC time is within the quiet hours window."""
-    if not start or not end:
-        return False
-    try:
-        now = datetime.now(timezone.utc).time()
-        t_start = time.fromisoformat(start)
-        t_end = time.fromisoformat(end)
-        if t_start <= t_end:
-            return t_start <= now <= t_end
-        else:
-            # Overnight window (e.g., 22:00 - 06:00)
-            return now >= t_start or now <= t_end
-    except (ValueError, TypeError):
-        return False
-
-
-def _event_allowed_by_config(event: ServiceEvent, tc: TrackingConfig) -> bool:
-    """Check if an event type is allowed by the tracking config's flags."""
-    event_type = event.event_type.value
-    flag_map = {
-        # Immich events
-        "assets_added": tc.track_assets_added,
-        "assets_removed": tc.track_assets_removed,
-        "collection_renamed": tc.track_collection_renamed,
-        "collection_deleted": tc.track_collection_deleted,
-        "sharing_changed": tc.track_sharing_changed,
-        # Gitea events
-        "push": tc.track_push,
-        "issue_opened": tc.track_issue_opened,
-        "issue_closed": tc.track_issue_closed,
-        "issue_commented": tc.track_issue_commented,
-        "pr_opened": tc.track_pr_opened,
-        "pr_closed": tc.track_pr_closed,
-        "pr_merged": tc.track_pr_merged,
-        "pr_commented": tc.track_pr_commented,
-        "release_published": tc.track_release_published,
-        # Scheduler events
-        "scheduled_message": tc.track_scheduled_message,
-    }
-    return flag_map.get(event_type, True)
-
-
 async def check_tracker(tracker_id: int) -> dict[str, Any]:
     """Poll a tracker's provider for changes and dispatch notifications."""
     engine = get_engine()
@@ -128,88 +77,8 @@ async def check_tracker(tracker_id: int) -> dict[str, Any]:
                 "shared": bool(s.shared),
             }
 
-        # Load tracker-target links (replaces old target_ids JSON array)
-        tt_result = await session.exec(
-            select(NotificationTrackerTarget).where(NotificationTrackerTarget.tracker_id == tracker_id)
-        )
-        tracker_targets = tt_result.all()
-
-        # For each link, load target + tracking config + template config
-        link_data: list[dict[str, Any]] = []
-        for tt in tracker_targets:
-            if not tt.enabled:
-                continue
-            if _in_quiet_hours(tt.quiet_hours_start, tt.quiet_hours_end):
-                continue
-
-            target = await session.get(NotificationTarget, tt.target_id)
-            if not target:
-                continue
-
-            # Load receivers for this target
-            recv_result = await session.exec(
-                select(TargetReceiver).where(
-                    TargetReceiver.target_id == target.id,
-                    TargetReceiver.enabled == True,
-                )
-            )
-            receivers = [dict(r.config) for r in recv_result.all()]
-
-            tracking_config = None
-            if tt.tracking_config_id:
-                tracking_config = await session.get(TrackingConfig, tt.tracking_config_id)
-
-            template_config = None
-            template_slots: dict[str, str] | None = None
-            if tt.template_config_id:
-                template_config = await session.get(TemplateConfig, tt.template_config_id)
-                if template_config:
-                    slot_result = await session.exec(
-                        select(TemplateSlot).where(TemplateSlot.config_id == template_config.id)
-                    )
-                    raw_slots = {s.slot_name: s.template for s in slot_result.all()}
-                    # Map slot names to event_type values for dispatcher lookup
-                    template_slots = {}
-                    for slot_name, tmpl_text in raw_slots.items():
-                        # Strip "message_" prefix for event-type slots
-                        event_key = slot_name.removeprefix("message_") if slot_name.startswith("message_") else slot_name
-                        template_slots[event_key] = tmpl_text
-
-            target_config = dict(target.config)
-            # Inject chat_action for Telegram targets
-            if hasattr(target, 'chat_action') and target.chat_action:
-                target_config["chat_action"] = target.chat_action
-            # Inject bot credentials for bot-backed target types
-            if target.type == "email":
-                email_bot_id = target.config.get("email_bot_id")
-                if email_bot_id:
-                    email_bot = await session.get(EmailBot, email_bot_id)
-                    if email_bot:
-                        target_config["smtp"] = {
-                            "host": email_bot.smtp_host,
-                            "port": email_bot.smtp_port,
-                            "username": email_bot.smtp_username,
-                            "password": email_bot.smtp_password,
-                            "from_address": email_bot.email,
-                            "from_name": email_bot.name,
-                            "use_tls": email_bot.smtp_use_tls,
-                        }
-            elif target.type == "matrix":
-                matrix_bot_id = target.config.get("matrix_bot_id")
-                if matrix_bot_id:
-                    matrix_bot = await session.get(MatrixBot, matrix_bot_id)
-                    if matrix_bot:
-                        target_config["homeserver_url"] = matrix_bot.homeserver_url
-                        target_config["access_token"] = matrix_bot.access_token
-
-            link_data.append({
-                "target_type": target.type,
-                "target_config": target_config,
-                "receivers": receivers,
-                "tracking_config": tracking_config,
-                "template_config": template_config,
-                "template_slots": template_slots,
-            })
+        # Load tracker-target links
+        link_data = await load_link_data(session, tracker_id, check_quiet_hours=True)
 
         # Snapshot the data we need
         provider_type = provider.type
@@ -327,7 +196,7 @@ async def check_tracker(tracker_id: int) -> dict[str, Any]:
             for ld in link_data:
                 # Apply per-link event filtering from tracking config
                 tc = ld["tracking_config"]
-                if tc and not _event_allowed_by_config(event, tc):
+                if tc and not event_allowed_by_config(event, tc):
                     _LOGGER.info("  Skipped by tracking config filter")
                     continue