fix: high-severity findings from code audit

- backend/photos: whitelist sortable columns instead of getattr(Photo, sort).
  Previously any client-supplied string was passed to SQLAlchemy, exposing
  every Photo attribute (filepath, file_hash, etc.) as a sort target.
- App: move the auto-show-right-sidebar logic out of the render body and
  into a useEffect. The previous version called setState during render,
  causing extra re-render passes the audit caught.
- types/photo: add added_at and tighten folder_id from optional to nullable.
  Drops a (photo as any).added_at cast in Timeline.
- constants/colorLabels: extract a single COLOR_LABEL_OPTIONS used by
  FilterBar, RightSidebar, and PhotoInfoPanel. filterStore re-exports the
  ColorLabel type so existing imports keep working.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/src/components/timeline/Timeline.tsx

@@ -137,9 +137,7 @@ function buildItems(
 
   photos.forEach((photo, globalIndex) => {
     const dateStr =
-      sortBy === 'taken_at'
-        ? photo.taken_at
-        : (photo as any).added_at ?? photo.taken_at
+      sortBy === 'taken_at' ? photo.taken_at : photo.added_at ?? photo.taken_at
     let label: string
     if (dateStr) {
       try {