fix(web): widget cache-busting, dead frontend code, and dependency pins (#656)

- Plugin-supplied widgets load as /static/plugin-widgets/...js?v=<plugin
  version>, so an update isn't hidden behind the year-long immutable cache.
- Fire-and-forget loadInstalledPlugins() calls catch the rejection it has
  already reported, so the global handler no longer adds a second toast.
- Timezone picker renders again when the General partial is re-injected.
- Remove dead code: executePluginAction's six plugin-id fallbacks and
  [DEBUG] logging, window.currentPluginConfig and every read of it, the
  file-upload JSON delete branch, unused PluginAPI / PluginInstallManager /
  PluginStateManager helpers, loadPluginWidgetsFromManifest, the stale
  install_manager.js and LEDVisibility fallbacks, error_handler.js's global
  escapeHtml, 13 unused CSS rules, and stale comments/no-op returns.
- pytz < 2027, psutil < 7 in requirements-test.txt, pytest-cov < 8.
- Pin anthropics/claude-code-action to the commit v1 resolves to.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

web_interface/templates/v3/base.html

@@ -275,17 +275,17 @@
     <!-- Alpine.js app function - defined early so it's available when Alpine initializes -->
     <script src="{{ url_for('static', filename='v3/js/app-early.js') }}"></script>
 
+    <!-- App shell (full app(), Alpine stores, SSE streams). Deferred so it
+         doesn't block rendering, and placed before Alpine: deferred scripts run
+         in document order, and its alpine:init listener must be registered
+         before Alpine starts. -->
+    <script defer src="{{ url_for('static', filename='v3/js/app-shell.js') }}"></script>
     <!-- Alpine.js for reactive components.
          Load the local copy first (always works, no CDN round-trip, no AP-mode
          branch needed). `defer` on an HTML-parsed <script> is honored and runs
          after DOM parse but before DOMContentLoaded, which is exactly what
          Alpine wants — so no deferLoadingAlpine gymnastics are needed.
          The inline rescue below only fires if the local file is missing. -->
-    <!-- App shell (full app(), Alpine stores, SSE streams). Deferred so it
-         doesn't block rendering, and placed before Alpine: deferred scripts run
-         in document order, and its alpine:init listener must be registered
-         before Alpine starts. -->
-    <script defer src="{{ url_for('static', filename='v3/js/app-shell.js') }}"></script>
     <script defer src="{{ url_for('static', filename='v3/js/alpinejs.min.js') }}"></script>
     <script>
         // Rescue: if the local Alpine didn't load for any reason, pull the CDN