feat: security hardening — SSRF guard, template sandbox timeout, webhook log prune, auth & backup polish

- Add outbound URL validation (SSRF) for webhook/Discord/Slack/ntfy/Matrix dispatch
- Template renderer: input/output caps and thread-based render timeout
- Webhook log filter: strip Authorization/signature/token-like headers; atomic prune
- Auth/JWT/backup/config tightening; misc frontend UX fixes

frontend/src/lib/providers/types.ts

@@ -40,7 +40,7 @@ export interface ConfigField {
 	min?: number;
 	max?: number;
 	/** Default value for this field. */
-	defaultValue?: string | number;
+	defaultValue?: string | number | boolean;
 }
 
 // ── Event tracking (TrackingConfig form) ─────────────────────────────
@@ -60,14 +60,14 @@ export interface EventTrackingField {
 export interface ExtraTrackingField {
 	key: string;
 	label: string;
-	type: 'number' | 'grid-select';
+	type: 'number' | 'grid-select' | 'toggle';
 	/** Grid-select item source function name from grid-items.ts. */
 	gridItems?: string;
 	gridColumns?: number;
 	hint?: string;
 	min?: number;
 	max?: number;
-	defaultValue?: string | number;
+	defaultValue?: string | number | boolean;
 }
 
 /** A feature section like periodic summary, scheduled assets, memory mode. */