security: add Trivy container scan to Docker publish workflow (#399)

* feat(admin): add backup manager UI with 1-click restore

* feat(admin): collapse older backup entries by default

* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle

* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards

* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)

* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards

* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards

* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar

* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx

* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile

* style(admin): replace all emojis with clean Leica-style vector SVG icons

* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons

* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings

* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode

* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx

* fix(types): add protection and watermark optional properties to AppConfig interface

* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)

* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator

* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules

* fix(types): import type LightboxWatermark in PhotoGrid.tsx

* fix(types): destructure watermark prop in PhotoGrid function signature

* feat(seo): add configurable subpage title template and metadata descriptions

* feat(seo): add generateMetadata to about page for title template support

* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal

* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts

* feat(subpages): add page enabled toggle to deactivate subpages without deleting them

* feat(admin): add visual essay block builder for photo essay storytelling pages

* security: add Trivy container scan to Docker publish workflow

Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>

app/api/admin/backups/route.ts

@@ -0,0 +1,109 @@
+import { NextResponse } from 'next/server';
+import { revalidatePath } from 'next/cache';
+import { isAdminAuthenticated, isAdminEnabled } from '@/lib/admin/auth';
+import { listBackups, restoreBackup } from '@/lib/admin/yaml-service';
+import { invalidateConfigCache } from '@/lib/config';
+import { immich } from '@/lib/immich';
+
+export interface BackupItem {
+  filename: string;
+  target: 'gallery' | 'settings';
+  timestamp: string | null;
+  isPreRestore: boolean;
+}
+
+function parseBackupInfo(filename: string): BackupItem {
+  const target = filename.startsWith('gallery.yaml') ? 'gallery' : 'settings';
+  const isPreRestore = filename.includes('pre-restore');
+
+  // Extract timestamp from filename like filename.2026-05-31T17-30-00-000Z.bak
+  const match = filename.match(/\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z/);
+  let timestamp: string | null = null;
+  if (match) {
+    // Reconstruct valid ISO string: 2026-05-31T17:30:00.000Z
+    const parts = match[0].split('T');
+    const datePart = parts[0];
+    const timeParts = parts[1].replace('Z', '').split('-');
+    if (timeParts.length >= 4) {
+      timestamp = `${datePart}T${timeParts[0]}:${timeParts[1]}:${timeParts[2]}.${timeParts[3]}Z`;
+    }
+  }
+
+  return {
+    filename,
+    target,
+    timestamp,
+    isPreRestore,
+  };
+}
+
+/** GET: List all available backups for gallery and settings. */
+export async function GET() {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  try {
+    const galleryRaw = await listBackups('gallery.yaml');
+    const settingsRaw = await listBackups('settings.yaml');
+
+    const gallery = galleryRaw.map(parseBackupInfo);
+    const settings = settingsRaw.map(parseBackupInfo);
+
+    return NextResponse.json({
+      backups: {
+        gallery,
+        settings,
+      },
+    });
+  } catch (err) {
+    console.error('[Admin API] Error listing backups:', err);
+    return NextResponse.json({ error: 'Failed to list backups' }, { status: 500 });
+  }
+}
+
+/** POST: Restore a specific backup file. */
+export async function POST(req: Request) {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  try {
+    const body = await req.json();
+    const { backupFilename } = body || {};
+
+    if (!backupFilename || typeof backupFilename !== 'string') {
+      return NextResponse.json({ error: 'backupFilename is required' }, { status: 400 });
+    }
+
+    // Security check: prevent directory traversal
+    if (backupFilename.includes('..') || backupFilename.includes('/') || backupFilename.includes('\\')) {
+      return NextResponse.json({ error: 'Invalid backup filename' }, { status: 400 });
+    }
+
+    if (!backupFilename.endsWith('.bak')) {
+      return NextResponse.json({ error: 'Invalid backup file extension' }, { status: 400 });
+    }
+
+    await restoreBackup(backupFilename);
+
+    // Invalidate caches & revalidate pages
+    invalidateConfigCache();
+    immich.invalidateAll();
+    revalidatePath('/', 'layout');
+
+    return NextResponse.json({
+      success: true,
+      message: `Successfully restored ${backupFilename}`,
+    });
+  } catch (err) {
+    console.error('[Admin API] Error restoring backup:', err);
+    return NextResponse.json({ error: 'Failed to restore backup' }, { status: 500 });
+  }
+}