fix: high-severity findings from code audit

- backend/photos: whitelist sortable columns instead of getattr(Photo, sort).
  Previously any client-supplied string was passed to SQLAlchemy, exposing
  every Photo attribute (filepath, file_hash, etc.) as a sort target.
- App: move the auto-show-right-sidebar logic out of the render body and
  into a useEffect. The previous version called setState during render,
  causing extra re-render passes the audit caught.
- types/photo: add added_at and tighten folder_id from optional to nullable.
  Drops a (photo as any).added_at cast in Timeline.
- constants/colorLabels: extract a single COLOR_LABEL_OPTIONS used by
  FilterBar, RightSidebar, and PhotoInfoPanel. filterStore re-exports the
  ColorLabel type so existing imports keep working.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/src/components/filter/FilterBar.tsx

@@ -4,11 +4,11 @@ import {
   useFilterStore,
   hasActiveFilters,
   type MediaType,
-  type ColorLabel,
   type SortField,
 } from '../../store/filterStore'
 import { useTagsQuery } from '../../hooks/useTagsQuery'
 import { FilterPill } from './FilterPill'
+import { COLOR_LABEL_OPTIONS } from '../../constants/colorLabels'
 
 const MEDIA_TYPES: { value: MediaType; label: string }[] = [
   { value: 'photo', label: 'Photo' },
@@ -17,15 +17,6 @@ const MEDIA_TYPES: { value: MediaType; label: string }[] = [
   { value: 'heic', label: 'HEIC' },
 ]
 
-const COLOR_LABEL_OPTIONS: { value: ColorLabel; className: string }[] = [
-  { value: 'red', className: 'bg-red-500' },
-  { value: 'orange', className: 'bg-orange-500' },
-  { value: 'yellow', className: 'bg-yellow-400' },
-  { value: 'green', className: 'bg-green-500' },
-  { value: 'blue', className: 'bg-blue-500' },
-  { value: 'purple', className: 'bg-purple-500' },
-]
-
 const SORT_OPTIONS: { value: SortField; label: string }[] = [
   { value: 'taken_at', label: 'Date taken' },
   { value: 'added_at', label: 'Date added' },

frontend/src/components/layout/RightSidebar.tsx

@@ -7,17 +7,7 @@ import { useActiveHeapMembers } from '../../hooks/useActiveHeapMembersQuery'
 import { HEAPS_QUERY_KEY } from '../../hooks/useHeapsQuery'
 import { toast } from '../ToastContainer'
 import { PhotoInfoPanel } from '../sidebar/PhotoInfoPanel'
-
-type ColorLabel = 'red' | 'orange' | 'yellow' | 'green' | 'blue' | 'purple'
-
-const COLOR_LABEL_OPTIONS: { value: ColorLabel; className: string }[] = [
-  { value: 'red', className: 'bg-red-500' },
-  { value: 'orange', className: 'bg-orange-500' },
-  { value: 'yellow', className: 'bg-yellow-400' },
-  { value: 'green', className: 'bg-green-500' },
-  { value: 'blue', className: 'bg-blue-500' },
-  { value: 'purple', className: 'bg-purple-500' },
-]
+import { COLOR_LABEL_OPTIONS } from '../../constants/colorLabels'
 
 /**
  * Right-hand details panel.

frontend/src/components/sidebar/PhotoInfoPanel.tsx

@@ -23,6 +23,10 @@ import { useActiveHeapMembers } from '../../hooks/useActiveHeapMembersQuery'
 import { HEAPS_QUERY_KEY } from '../../hooks/useHeapsQuery'
 import { useTagsQuery, TAGS_QUERY_KEY } from '../../hooks/useTagsQuery'
 import { toast } from '../ToastContainer'
+import {
+  COLOR_LABEL_OPTIONS,
+  type ColorLabel,
+} from '../../constants/colorLabels'
 
 interface PhotoTagSummary {
   id: string
@@ -47,17 +51,6 @@ interface PhotoDetails {
   tags?: PhotoTagSummary[]
 }
 
-type ColorLabel = 'red' | 'orange' | 'yellow' | 'green' | 'blue' | 'purple'
-
-const COLOR_LABEL_OPTIONS: { value: ColorLabel; className: string }[] = [
-  { value: 'red', className: 'bg-red-500' },
-  { value: 'orange', className: 'bg-orange-500' },
-  { value: 'yellow', className: 'bg-yellow-400' },
-  { value: 'green', className: 'bg-green-500' },
-  { value: 'blue', className: 'bg-blue-500' },
-  { value: 'purple', className: 'bg-purple-500' },
-]
-
 interface ExifData {
   Make?: string
   Model?: string

frontend/src/components/timeline/Timeline.tsx

@@ -137,9 +137,7 @@ function buildItems(
 
   photos.forEach((photo, globalIndex) => {
     const dateStr =
-      sortBy === 'taken_at'
-        ? photo.taken_at
-        : (photo as any).added_at ?? photo.taken_at
+      sortBy === 'taken_at' ? photo.taken_at : photo.added_at ?? photo.taken_at
     let label: string
     if (dateStr) {
       try {