fix(server): harden deployment, media, state, jobs

- Lock down /media/: deny state.json, DBs, sessions; allowlist extensions incl. archives/docs (M-1)
- parse_bool() fixes; HEAD 404; shutdown drains queue; range edge cases (M-3, M-4, M-7, M-8)
- int() coercion -> 400; no filesystem paths in errors; path-only access log (M-19, L-1)
- Security headers, QR TTL 60s, trusted-host allowlist, legacy add/remove via update() (L-4, L-5, L-6, L-8)
- Clean continuous channels on import and migration; restart-during-drain; tombstone managers (F-1, F-3, F-4)
- Durability: fsync + unique tmp + stale sweep + 0600/0700 perms (M-10, M-18)
- Jobs run on dedicated loop thread; set_scrape_media passthrough; media chunked; state throttled;
  exact media file reuse; honest scrape failure status (M-11, M-12, M-13, M-14)
- Health aggregates per-account; legacy GETs delegate post-migration (M-15, M-9)
- k8s: runAsNonRoot 1000 + resource limits, no readOnlyRootFilesystem (M-16)
- UI: dropped-invalid and credentials-reentry toasts; swagger XSS-safe (F-2, L-9, L-2)
- CI: non-blocking pip-audit job in both workflows (L-3)
- 50 tests passing; REVIEW.md updated (C-1/M-20 won't fix: local-only by design)

health.py

@@ -2,7 +2,7 @@ import sqlite3
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 
-from app_state import StateStore
+from app_state import StateStore, load_account
 
 
 def health_payload(
@@ -73,6 +73,28 @@ def _dir_check(path: Path, writable: bool = False) -> Dict[str, Any]:
 def _state_check(state_store: StateStore) -> Dict[str, Any]:
     try:
         state = state_store.load()
+        data_dir = state_store.path.parent
+        accounts = state.get("accounts") or []
+
+        if accounts:
+            # Multi-account mode: the global store no longer holds api
+            # credentials / channels.  Aggregate those from each account's own
+            # state file so the reported values are meaningful.
+            has_api_credentials = False
+            tracked_channels = 0
+            for acc_id in accounts:
+                acc = load_account(data_dir, acc_id)
+                if acc.get("api_id") and acc.get("api_hash"):
+                    has_api_credentials = True
+                tracked_channels += len(acc.get("channels", {}) or {})
+            return {
+                "ok": True,
+                "path": str(state_store.path),
+                "has_api_credentials": has_api_credentials,
+                "tracked_channels": tracked_channels,
+            }
+
+        # Legacy single-account semantics (no accounts list).
         return {
             "ok": True,
             "path": str(state_store.path),