upload unique links + default upload page + login

app/config.py

@@ -6,6 +6,8 @@ Reads ONLY from .env; there is NO runtime mutation from the UI.
 from __future__ import annotations
 import os
 from dataclasses import dataclass
+import secrets
+from dotenv import load_dotenv
 
 
 @dataclass
@@ -15,6 +17,11 @@ class Settings:
     immich_api_key: str
     max_concurrent: int = 3
     album_name: str = ""
+    public_upload_page_enabled: bool = False
+    public_base_url: str = ""
+    state_db: str = "./state.db"
+    session_secret: str = ""
+    log_level: str = "INFO"
 
     @property
     def normalized_base_url(self) -> str:
@@ -23,11 +30,35 @@ class Settings:
 
 def load_settings() -> Settings:
     """Load settings from .env, applying defaults when absent."""
+    # Load environment variables from .env once here so importers don’t have to
+    try:
+        load_dotenv()
+    except Exception:
+        pass
     base = os.getenv("IMMICH_BASE_URL", "http://127.0.0.1:2283/api")
     api_key = os.getenv("IMMICH_API_KEY", "")
     album_name = os.getenv("IMMICH_ALBUM_NAME", "")
+    # Safe defaults: disable public uploader and invites unless explicitly enabled
+    def as_bool(v: str, default: bool = False) -> bool:
+        if v is None:
+            return default
+        return str(v).strip().lower() in {"1","true","yes","on"}
+    public_upload = as_bool(os.getenv("PUBLIC_UPLOAD_PAGE_ENABLED", "false"), False)
     try:
         maxc = int(os.getenv("MAX_CONCURRENT", "3"))
     except ValueError:
         maxc = 3
-    return Settings(immich_base_url=base, immich_api_key=api_key, max_concurrent=maxc, album_name=album_name)
+    state_db = os.getenv("STATE_DB", "./state.db")
+    session_secret = os.getenv("SESSION_SECRET") or secrets.token_hex(32)
+    log_level = os.getenv("LOG_LEVEL", "INFO").upper()
+    return Settings(
+        immich_base_url=base,
+        immich_api_key=api_key,
+        max_concurrent=maxc,
+        album_name=album_name,
+        public_upload_page_enabled=public_upload,
+        public_base_url=os.getenv("PUBLIC_BASE_URL", ""),
+        state_db=state_db,
+        session_secret=session_secret,
+        log_level=log_level,
+    )