chore: remove dead code, deprecate unused plugin APIs (over-engineering audit) (#783)

* chore: remove dead code, deprecate unused plugin APIs (over-engineering audit)

Whole-tree audit. Every symbol was checked against core, the plugin
monorepo and all eight third-party plugins in plugins.json first.

- Deprecate (removal 3.10.0) plugin-facing methods nothing calls:
  LogoDownloader bulk download, ConfigManager backup/secret wrappers,
  APIHelper extras, BackgroundDataService poll API, PluginManager /
  PluginStateManager info readers, and a few CacheManager, FontManager,
  BaseOddsManager, DynamicTeamResolver methods and PluginTestCase.
  plugin_api_usage.py learns their receiver names; DEPRECATIONS doc
  regenerated.
- Remove core-internal dead code: CacheMetrics, Vegas status/stats
  plumbing, sync "new cycle" message (followers ignore unknown types),
  unused operation types, test-only PluginCatalog readers, IPC to_dict
  and ping, _parse_form_value, CacheStrategyProtocol, ErrorAggregator
  callbacks, duplicate web response helpers.
- Web UI: drop never-mounted json-file-manager.js, the example widget,
  utils/error_handler.js, four uncalled PluginAPI methods, and 29
  escapeHtml shims (call window.LEDEscape directly). Public globals,
  BaseWidget and widget names unchanged.
- Remove six one-off scripts (owner decision) and the unused markupsafe
  and pytest-mock pins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(web): calendar picker error text goes in a text node, not innerHTML

Same output as the escaped innerHTML it replaces; clears Codacy's
XSS-pattern alerts on the line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

src/web_interface/api_helpers.py

@@ -8,7 +8,6 @@ import time
 from typing import Any, Optional, Dict, Tuple
 from flask import jsonify, request
 
-from src.web_interface.error_handler import create_error_response, create_success_response
 from src.web_interface.errors import ErrorCode, WebInterfaceError
 
 
@@ -31,7 +30,15 @@ def success_response(
     Returns:
         Flask jsonify response
     """
-    response_data = create_success_response(data, message, metadata)
+    response_data: Dict[str, Any] = {'status': 'success'}
+    # `is not None` rather than truthiness: "" and {} are values a caller
+    # chose to send, and dropping them would make the shape depend on the data.
+    if data is not None:
+        response_data['data'] = data
+    if message is not None:
+        response_data['message'] = message
+    if metadata is not None:
+        response_data['metadata'] = metadata
     for key, value in (extra or {}).items():
         response_data.setdefault(key, value)
 
@@ -70,14 +77,14 @@ def error_response(
     Returns:
         Flask jsonify response with status code
     """
-    return create_error_response(
+    error = WebInterfaceError(
         error_code=error_code,
         message=message,
         details=details,
-        context=context,
-        suggested_fixes=suggested_fixes,
-        status_code=status_code
+        context=context or {},
+        suggested_fixes=suggested_fixes
     )
+    return jsonify(error.to_dict()), status_code
 
 
 def exception_error_response(

src/web_interface/config_arrays.py

@@ -12,8 +12,8 @@ from typing import Any, Dict
 def _schema_type_is(prop: Any, wanted: str) -> bool:
     """Whether a schema property is of ``wanted`` type, unions included.
 
-    Mirrors ``_schema_type_is`` in ``web_interface/blueprints/api_v3`` (kept
-    here so src/ doesn't import the Flask blueprint). A union such as
+    The one copy: ``web_interface/blueprints/api_v3`` imports it from here
+    (src/ must not import the Flask blueprint). A union such as
     ``["array", "null"]`` -- the per-element style overrides, where null means
     "inherit" -- is still an array for recombining position-keyed inputs.
     """

src/web_interface/error_handler.py

@@ -1,20 +1,13 @@
 """
-Centralized error handling for web interface.
+Error text and payloads for web interface responses.
 
-Provides helpers for consistent error responses across API endpoints.
+Safe exception descriptions and the bodies for exceptions no route handled.
+The standard success/error responses are in api_helpers.
 """
 
-from typing import Any, Optional
-from flask import jsonify
-
-from src.web_interface.errors import WebInterfaceError, ErrorCode
-from src.logging_config import get_logger
 from src.redaction import redact_credentials
 
 
-logger = get_logger(__name__)
-
-
 # Long enough for an errno string with a path, short enough not to dump a
 # parser's worth of context into a JSON field.
 _MAX_DETAIL_LENGTH = 400
@@ -101,72 +94,3 @@ def http_exception_payload(error) -> dict:
         'error_code': (error.name or 'HTTP_ERROR').upper().replace(' ', '_'),
         'message': error.description,
     }
-
-
-def create_error_response(
-    error_code: ErrorCode,
-    message: str,
-    details: Optional[str] = None,
-    context: Optional[dict] = None,
-    suggested_fixes: Optional[list] = None,
-    status_code: int = 500
-) -> tuple:
-    """
-    Create a standardized error response.
-    
-    Args:
-        error_code: Error code
-        message: Error message
-        details: Optional detailed error information
-        context: Optional context dictionary
-        suggested_fixes: Optional list of suggested fixes
-        status_code: HTTP status code
-    
-    Returns:
-        Tuple of (jsonify response, status_code)
-    """
-    error = WebInterfaceError(
-        error_code=error_code,
-        message=message,
-        details=details,
-        context=context or {},
-        suggested_fixes=suggested_fixes
-    )
-    
-    return jsonify(error.to_dict()), status_code
-
-
-def create_success_response(
-    data: Any = None,
-    message: Optional[str] = None,
-    metadata: Optional[dict] = None
-) -> dict:
-    """
-    Create a standardized success response.
-    
-    Args:
-        data: Response data
-        message: Optional success message
-        metadata: Optional metadata (timing, version, etc.)
-    
-    Returns:
-        Dictionary for jsonify
-    """
-    response: dict[str, Any] = {
-        "status": "success"
-    }
-    
-    # All three use `is not None` rather than truthiness: "" and {} are
-    # values a caller chose to send, and dropping them silently would make
-    # the response shape depend on the data.
-    if data is not None:
-        response["data"] = data
-
-    if message is not None:
-        response["message"] = message
-
-    if metadata is not None:
-        response["metadata"] = metadata
-
-    return response
-

src/web_interface/errors.py

@@ -61,27 +61,14 @@ class WebInterfaceError:
     context: Optional[Dict[str, Any]] = None
     suggested_fixes: Optional[List[str]] = None
     original_error: Optional[Exception] = None
-    
-    def __init__(
-        self,
-        error_code: ErrorCode,
-        message: str,
-        details: Optional[str] = None,
-        context: Optional[Dict[str, Any]] = None,
-        suggested_fixes: Optional[List[str]] = None,
-        original_error: Optional[Exception] = None
-    ):
-        self.error_code = error_code
-        self.message = message
-        self.details = details
-        self.context = context or {}
+
+    def __post_init__(self) -> None:
+        self.context = self.context or {}
         # `is None`, not truthiness: an explicit [] means "this caller has
         # no suggestions to offer", which the default list would override.
-        self.suggested_fixes = (
-            suggested_fixes if suggested_fixes is not None
-            else self._get_default_suggestions(error_code))
-        self.original_error = original_error
-    
+        if self.suggested_fixes is None:
+            self.suggested_fixes = self._get_default_suggestions(self.error_code)
+
     def _get_default_suggestions(self, error_code: ErrorCode) -> List[str]:
         """Get default suggested fixes for error code."""
         suggestions_map = {