feat: security hardening — SSRF guard, template sandbox timeout, webhook log prune, auth & backup polish

- Add outbound URL validation (SSRF) for webhook/Discord/Slack/ntfy/Matrix dispatch
- Template renderer: input/output caps and thread-based render timeout
- Webhook log filter: strip Authorization/signature/token-like headers; atomic prune
- Auth/JWT/backup/config tightening; misc frontend UX fixes

frontend/src/routes/bots/EmailBotTab.svelte

@@ -21,7 +21,7 @@
 	let editingEmail = $state<number | null>(null);
 	let emailSubmitting = $state(false);
 	let emailTesting = $state<Record<number, boolean>>({});
-	let confirmDeleteEmail = $state<EmailBot | null>(null);
+	let confirmDeleteEmail = $state<{ id: number; onconfirm: () => Promise<void> } | null>(null);
 	let error = $state('');
 
 	const defaultEmailForm = () => ({