fix(web): plugin dir resolver in routes, nmcli AP detection, daemon config reload, upload safety, BDF preview (#655)

* fix(web): plugin dir resolver in routes, nmcli AP detection, daemon config reload, upload safety

- Route plugin lookups (installed list, update, recorded version, config
  form, web UI pages) through the plugin manager's resolver so plugins in
  ledmatrix-<id> directories work.
- Captive-portal detection also sees the nmcli fallback AP (cached).
- WiFi monitor daemon re-reads wifi_config.json when its mtime changes.
- Drop the AP check in disconnect_from_network that could never fire.
- LED status file per WiFiManager; config path falls back to this checkout.
- BDF font preview via src.common.bdf_font.
- Asset uploads validate every file before saving; metadata and calendar
  credentials written atomically; no absolute path in the response;
  asset delete answers 400 for a missing body.
- Coerce string booleans in plugin toggle, on-demand start and AP force.
- SSE broadcaster clears its thread handle before exiting.
- start.py log filter handles every exc_info form.
- Cleanups: unused plugins/fonts partial work, duplicate backup catch-alls,
  raw-config error helper, update-route tidy, redundant imports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(web): request BDF font previews now that the server renders them

The Fonts tab skipped the preview request for .bdf files because the server
used to refuse them; /fonts/preview now draws BDF with the shared loader.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(web): take the update route's plugin directory from a directory listing

CodeQL flagged the path built from the request's plugin_id (the id was
already validated with safe_path_component, which CodeQL doesn't model; the
same flow on main is alerts 738/739). The directory is now the entry of
plugins_dir matched by name, so nothing built from user input reaches the
filesystem; an id with nothing installed goes to the store manager, which
reports it not found as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(web): read the blueprint's plugin_manager defensively in _plugin_directory

_get_plugin_version now goes through _plugin_directory, which read
api_v3.plugin_manager directly; the attribute exists only once the app sets
it, so test_path_traversal_guards::test_a_real_manifest_is_read failed
when run on its own (order-dependent in the full suite).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

test/web_interface/test_api_v3_config_raw.py

@@ -178,6 +178,25 @@ class TestSaveRawSecrets:
         monkeypatch.setattr(env.config_manager, "save_raw_file_content", boom)
         assert env.client.post(SECRETS, json={"a": 1}).status_code == 500
 
+    @pytest.mark.parametrize("error,code", [
+        (ConfigError("cannot write", config_path="/etc/s.json"), "CONFIG_SAVE_FAILED"),
+        (RuntimeError("nope"), "UNKNOWN_ERROR"),
+    ])
+    def test_errors_answer_in_the_main_routes_shape(self, env, monkeypatch, error, code):
+        # Both raw routes build their 500 with one helper now; this one used
+        # to hand-roll a body without error_code or context. raw_json.html
+        # reads only `message`, which both shapes carry.
+        def boom(kind, data):
+            raise error
+        monkeypatch.setattr(env.config_manager, "save_raw_file_content", boom)
+        secrets = env.client.post(SECRETS, json={"a": 1})
+        main = env.client.post(MAIN, json={"a": 1})
+        assert secrets.status_code == main.status_code == 500
+        body = secrets.get_json()
+        assert body["error_code"] == code
+        assert body["message"] == main.get_json()["message"]
+        assert set(body) == set(main.get_json())
+
 
 class TestRawEndpointsBypassSecretSeparation:
     """Pinned behaviour, deliberately not "fixed".