feat: security hardening — SSRF guard, template sandbox timeout, webhook log prune, auth & backup polish

- Add outbound URL validation (SSRF) for webhook/Discord/Slack/ntfy/Matrix dispatch
- Template renderer: input/output caps and thread-based render timeout
- Webhook log filter: strip Authorization/signature/token-like headers; atomic prune
- Auth/JWT/backup/config tightening; misc frontend UX fixes

frontend/src/routes/bots/EmailBotTab.svelte

@@ -21,7 +21,7 @@
 	let editingEmail = $state<number | null>(null);
 	let emailSubmitting = $state(false);
 	let emailTesting = $state<Record<number, boolean>>({});
-	let confirmDeleteEmail = $state<EmailBot | null>(null);
+	let confirmDeleteEmail = $state<{ id: number; onconfirm: () => Promise<void> } | null>(null);
 	let error = $state('');
 
 	const defaultEmailForm = () => ({

frontend/src/routes/bots/MatrixBotTab.svelte

@@ -21,7 +21,7 @@
 	let editingMatrix = $state<number | null>(null);
 	let matrixSubmitting = $state(false);
 	let matrixTesting = $state<Record<number, boolean>>({});
-	let confirmDeleteMatrix = $state<MatrixBot | null>(null);
+	let confirmDeleteMatrix = $state<{ id: number; onconfirm: () => Promise<void> } | null>(null);
 	let error = $state('');
 
 	const defaultMatrixForm = () => ({

frontend/src/routes/bots/TelegramBotTab.svelte

@@ -375,12 +375,14 @@
 								<div style={gridStyle}
 									class="text-sm px-2 py-1.5 rounded hover:bg-[var(--color-muted)] cursor-pointer"
 									onclick={(e: MouseEvent) => copyChatId(e, chat.chat_id)}
+									onkeydown={(e: KeyboardEvent) => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); copyChatId(e as unknown as MouseEvent, chat.chat_id); } }}
 									title={t('telegramBot.clickToCopy')}
+									aria-label={t('telegramBot.clickToCopy')}
 									role="button" tabindex="0">
 									<span class="font-medium truncate">{chat.title || chat.username || t('common.unknown')}</span>
 									<span style="text-align:center" class="text-xs px-1.5 py-0.5 rounded bg-[var(--color-muted)] text-[var(--color-muted-foreground)]">{chatTypeLabel(chat.type)}</span>
 									<span style="text-align:center" class="text-xs text-[var(--color-muted-foreground)]">{(chat.language_code || '—').toUpperCase()}</span>
-									<div style="justify-self:center" onclick={(e: MouseEvent) => e.stopPropagation()}>
+									<div style="justify-self:center" role="presentation" onclick={(e: MouseEvent) => e.stopPropagation()} onkeydown={(e: KeyboardEvent) => e.stopPropagation()}>
 										<EntitySelect
 											items={LANG_ITEMS}
 											value={chat.language_override || ''}
@@ -388,7 +390,7 @@
 											onselect={(val) => updateChatLanguage(bot.id, chat, String(val ?? ''))}
 										/>
 									</div>
-									<div style="justify-self:center" onclick={(e: MouseEvent) => e.stopPropagation()}>
+									<div style="justify-self:center" role="presentation" onclick={(e: MouseEvent) => e.stopPropagation()} onkeydown={(e: KeyboardEvent) => e.stopPropagation()}>
 										<button
 											style="width:28px; height:16px; border-radius:8px; position:relative; transition:background-color 0.2s; background-color:{chat.commands_enabled ? 'var(--color-primary)' : 'var(--color-border)'};"
 											title={t('telegramBot.commandsToggle')}