feat: security hardening — SSRF guard, template sandbox timeout, webhook log prune, auth & backup polish

- Add outbound URL validation (SSRF) for webhook/Discord/Slack/ntfy/Matrix dispatch
- Template renderer: input/output caps and thread-based render timeout
- Webhook log filter: strip Authorization/signature/token-like headers; atomic prune
- Auth/JWT/backup/config tightening; misc frontend UX fixes

frontend/src/routes/settings/backup/+page.svelte

@@ -352,7 +352,7 @@
 					<div class="mb-4 p-3 rounded-md text-xs border" style="border-color: var(--color-border);">
 						<div class="flex items-center gap-2 mb-2 font-medium">
 							{#if validationResult.valid}
-								<MdiIcon name="mdiCheckCircle" size={14} class="text-green-600" />
+								<span style="color: var(--color-success-fg, green);"><MdiIcon name="mdiCheckCircle" size={14} /></span>
 								<span style="color: var(--color-success-fg, green);">{t('backup.validationPassed')}</span>
 							{:else}
 								<MdiIcon name="mdiCloseCircle" size={14} />