security: add Trivy container scan to Docker publish workflow (#399)

* feat(admin): add backup manager UI with 1-click restore

* feat(admin): collapse older backup entries by default

* fix(theme): isolate admin layout, instant DOM theme updates, and add Light/Dark mode toggle

* feat(admin): replace text controls for Photo Frame and Hero Style with visual preview cards

* fix(admin): define missing CSS rules for button system (.btn, .preset-btn)

* feat(admin): redesign theme settings with segmented mode toggle, accent color swatches, and custom iOS-style toggle cards

* feat(admin): upgrade all settings tabs with visual grid previews, Google SEO snippet preview, and toggle cards

* feat(admin): overhaul Pages Builder UX with slide-over drawer, card hover badges, real-time search, and floating save bar

* fix(admin): remove leftover dangling syntax snippet in PageBuilder.tsx

* fix(admin): add position: relative to subpage-tile so hover overlay is contained inside the tile

* style(admin): replace all emojis with clean Leica-style vector SVG icons

* fix(types): extend IconProps with SVGProps to allow style prop on Leica SVG icons

* feat(admin): add subpage live-preview, privacy analytics, and asset protection settings

* fix(typecheck): fix AlbumEntry property access in subpage drawer preview mode

* fix(types): fix ImmichAlbumInfo property names thumbnailAssetId and albumName in PageBuilder.tsx

* fix(types): add protection and watermark optional properties to AppConfig interface

* feat(settings): add toggle for disabling analytics tracking (defaults to enabled)

* feat(ux): show status banner when analytics tracking is disabled + add live sync indicator

* feat(watermark): render customizable watermark overlay on Lightbox images + rename section to Portfolio Features & Modules

* fix(types): import type LightboxWatermark in PhotoGrid.tsx

* fix(types): destructure watermark prop in PhotoGrid function signature

* feat(seo): add configurable subpage title template and metadata descriptions

* feat(seo): add generateMetadata to about page for title template support

* feat(proofing): add client proofing, favorites selection, compact URL bitmasking, and export modal

* feat(essay): add Photo Essay storytelling mode with RSC markdown parser and fullbleed/pair layouts

* feat(subpages): add page enabled toggle to deactivate subpages without deleting them

* feat(admin): add visual essay block builder for photo essay storytelling pages

* security: add Trivy container scan to Docker publish workflow

Scans the built image for CRITICAL/HIGH CVEs on every release and
uploads results to the GitHub Security tab. Non-blocking for now
(exit-code 0) so releases aren't gated on findings. Also documents
the scan and existing Dependabot coverage in the README.

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>

lib/immich.ts

@@ -452,12 +452,13 @@ class ImmichClient {
    * Get enriched subpage summaries for the homepage.
    */
   async getSubpages(): Promise<SubpageSummary[]> {
-    if (this.config.subpages.length === 0) return [];
+    const activeSubpages = this.config.subpages.filter((sp) => sp.enabled !== false);
+    if (activeSubpages.length === 0) return [];
 
     const albums = await this.getAlbums();
     const albumMap = new Map(albums.map((a) => [a.id, a]));
 
-    return this.config.subpages.map((sp) => {
+    return activeSubpages.map((sp) => {
       const spAlbums = sp.albumIds
         .map((id) => albumMap.get(id))
         .filter((a): a is ImmichAlbum => a !== undefined);
@@ -478,7 +479,9 @@ class ImmichClient {
   async getSubpageAlbums(
     subpageSlug: string,
   ): Promise<{ subpage: SubpageConfig; albums: ImmichAlbum[] } | null> {
-    const subpage = this.config.subpages.find((sp) => sp.slug === subpageSlug);
+    const subpage = this.config.subpages.find(
+      (sp) => sp.slug === subpageSlug && sp.enabled !== false,
+    );
     if (!subpage) return null;
 
     const allAlbums = await this.getAlbums();
@@ -626,7 +629,7 @@ class ImmichClient {
    * Check if a slug corresponds to a subpage.
    */
   isSubpageSlug(slug: string): boolean {
-    return this.config.subpages.some((sp) => sp.slug === slug);
+    return this.config.subpages.some((sp) => sp.slug === slug && sp.enabled !== false);
   }
 
   /**