fix(security): demo sends nothing, hidden SMTP password, body limits (FLAW-33..38)

- Demo: senders for mail, Discord and webhooks refuse, no alarm ticker;
  test alarm, SMTP test, server settings, backups, account and session
  changes of the shared demo accounts answer 403; the session list only
  shows the own device. The UI shows the notices and disables the controls.
- SMTP password is never sent back (smtpPassSet), empty keeps it.
- ?token= on webhook ingest accepts only API keys.
- Request bodies capped at 2 MB (sync 8 MB, imports 101 MB).
- Deleting an account removes its server backups.
- Backup downloads, exports and import uploads get 30 minutes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/models.go

@@ -285,10 +285,13 @@ type SystemSettings struct {
 	SMTPHost          string `json:"smtpHost"`
 	SMTPPort          string `json:"smtpPort"`
 	SMTPUser          string `json:"smtpUser"`
-	SMTPPass          string `json:"smtpPass"`
-	SMTPFrom          string `json:"smtpFrom"`
-	SMTPTLS           bool   `json:"smtpTls"`
-	SMTPSkipVerify    bool   `json:"smtpSkipVerify"` // accept self-signed certificates
+	// SMTPPass is never sent to the browser (FLAW-34): reads leave it empty and set SMTPPassSet;
+	// writing it empty keeps the stored password
+	SMTPPass       string `json:"smtpPass"`
+	SMTPPassSet    bool   `json:"smtpPassSet,omitempty"`
+	SMTPFrom       string `json:"smtpFrom"`
+	SMTPTLS        bool   `json:"smtpTls"`
+	SMTPSkipVerify bool   `json:"smtpSkipVerify"` // accept self-signed certificates
 	// AllowPrivateWebhooks lets alarm webhooks reach LAN addresses (and plain http); localhost and cloud
 	// metadata stay blocked
 	AllowPrivateWebhooks bool `json:"allowPrivateWebhooks"`