Miscellaneous fixes (#24970)

* analytics notifications flag and device grant warnings

- report notifications as on when any camera enables them, not only the global setting
- don't warn about device nodes the runtime users can already use, such as world-rw nodes in an unprivileged LXC

* clarify which stream the All Cameras dashboard uses

* add exception catchall for autotracking calibration

* only default review api after to 24 hours when no bounds are given

The review endpoint replaced a missing or zero `after` with 24 hours ago, so a `before`-only query older than 24 hours returned nothing and `after=0` couldn't mean no lower bound. The default now applies only when neither `before` nor `after` is sent, a `before`-only query has no lower bound, and both bounds use `is not None` checks. The Live dashboard alerts bar sends no bounds and keeps the 24 hour window.

docker/main/rootfs/etc/s6-overlay/s6-rc.d/init-devices/run

@@ -57,6 +57,17 @@ done
 granted=0
 failed=0
 
+reachable() {
+    local node="$1" user
+    local access=(-r "$node" -a -w "$node")
+    if [[ -d "$node" ]]; then
+        access=(-r "$node" -a -x "$node")
+    fi
+    for user in frigate go2rtc; do
+        s6-setuidgid "$user" test "${access[@]}" || return 1
+    done
+}
+
 grant() {
     local node="$1"
     # nullglob only drops patterns that hold a metacharacter, so a literal
@@ -72,6 +83,11 @@ grant() {
     fi
     if setfacl -m "$spec" "$node" 2>/dev/null; then
         granted=$((granted + 1))
+
+    # an unprivileged LXC can't set ACLs on its idmapped nodes, which are often
+    # already world-rw
+    elif reachable "$node"; then
+        return 0
     else
         failed=$((failed + 1))
         echo "[WARN] could not grant device access on ${node}; see EXTRA_GROUPS in the non-root docs for the fallback"