feat: security hardening — SSRF guard, template sandbox timeout, webhook log prune, auth & backup polish

- Add outbound URL validation (SSRF) for webhook/Discord/Slack/ntfy/Matrix dispatch
- Template renderer: input/output caps and thread-based render timeout
- Webhook log filter: strip Authorization/signature/token-like headers; atomic prune
- Auth/JWT/backup/config tightening; misc frontend UX fixes

frontend/src/routes/command-configs/+page.svelte

@@ -57,15 +57,6 @@
 		favorites: 'mdiStar', people: 'mdiAccountGroup',
 	};
 
-	let allCapabilities = $derived(capabilitiesCache.items);
-	let providerCommands = $derived<{key: string, icon: string}[]>(
-		(allCapabilities[form.provider_type]?.commands || []).map((c: { name: string }) => ({
-			key: c.name,
-			icon: commandIcons[c.name] || 'mdiConsole',
-		}))
-	);
-	let hasCommands = $derived(providerCommands.length > 0);
-
 	const defaultForm = () => ({
 		name: '',
 		icon: '',
@@ -78,6 +69,15 @@
 	});
 	let form = $state(defaultForm());
 
+	let allCapabilities = $derived(capabilitiesCache.items);
+	let providerCommands = $derived<{key: string, icon: string}[]>(
+		(allCapabilities[form.provider_type]?.commands || []).map((c: { name: string }) => ({
+			key: c.name,
+			icon: commandIcons[c.name] || 'mdiConsole',
+		}))
+	);
+	let hasCommands = $derived(providerCommands.length > 0);
+
 	onMount(load);
 	async function load() {
 		try {