- config.py: stop writing API_KEY to .immich_config.json; direct users to .env instead. Resolves CodeQL py/clear-text-storage-sensitive-data. - test.yml, lint.yml: add permissions: contents: read to satisfy actions/missing-workflow-permissions scanner. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>