fix: web UI and src.common bugs (wifi wrong-password, plugin icon, starlark toggle, API caching, scroll/logo/font helpers) (#646)

- wifi: keep the "wrong_password:" prefix through the restore/AP fallback so
  the UI's incorrect-password prompt fires again.
- /plugins/installed returns the manifest's icon (string only).
- /starlark/apps/<id>/toggle coerces `enabled` and delegates to
  _toggle_starlark_app (disk before memory, no KeyError, "false" is false).
- /api/v3/ JSON GETs are sent Cache-Control: no-store; non-JSON keeps 5s.
- ScrollHelper.set_scrolling_image converts non-RGB input (alpha onto black);
  create/set_scrolling_image reset last_update_time like reset_scroll.
- LogoHelper backs off a failed download per path for
  MISSING_LOGO_RECHECK_SECONDS; cleared on invalidate/clear_cache.
- refresh_placeholder_timestamp saves atomically.
- FontManager.clear_cache / _clear_plugin_font_cache bump cache_generation.
- Odds manager: per-game logs to DEBUG; JSON decode error caught before
  RequestException (same cooldown).
- element_style mangled continuations; startup validator skips null plugin
  blocks and reuses the controller's discovery.
- src/common/README lists frame_timing, json_body, render_gate.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

test/test_api_v3_installed_plugin_icon.py

@@ -0,0 +1,46 @@
+"""GET /api/v3/plugins/installed carries the manifest's `icon`.
+
+The tab nav sets ``iconEl.className = plugin.icon || 'fas fa-puzzle-piece'``
+(app-shell.js, app-early.js), but the route never included `icon`, so every
+plugin tab showed the default puzzle piece.
+"""
+
+from unittest.mock import MagicMock
+
+import pytest
+
+from test._api_v3_test_helpers import (  # noqa: F401 - fixtures
+    api_v3_client, api_v3_module,
+)
+
+
+@pytest.fixture
+def installed(api_v3_module, api_v3_client, tmp_path):
+    def _get(manifest_extra):
+        api = api_v3_module.api_v3
+        info = {'id': 'demo', 'name': 'Demo', 'version': '1.0.0', 'loaded': False}
+        info.update(manifest_extra)
+        api.plugin_manager.plugins_dir = str(tmp_path)  # no manifest on disk
+        api.plugin_manager.get_all_plugin_info = MagicMock(return_value=[info])
+        api.plugin_manager.get_plugin = MagicMock(return_value=None)
+        api.plugin_store_manager.get_registry_info = MagicMock(return_value=None)
+        api.config_manager.load_config = MagicMock(return_value={})
+        response = api_v3_client.get('/api/v3/plugins/installed')
+        assert response.status_code == 200
+        plugins = [p for p in response.get_json()['data']['plugins'] if p['id'] == 'demo']
+        assert len(plugins) == 1
+        return plugins[0]
+    return _get
+
+
+def test_the_manifest_icon_is_passed_through(installed):
+    assert installed({'icon': 'fas fa-cloud-sun'})['icon'] == 'fas fa-cloud-sun'
+
+
+def test_no_icon_comes_back_as_null(installed):
+    # The JS falls back to the puzzle piece on a falsy value.
+    assert installed({})['icon'] is None
+
+
+def test_a_non_string_icon_is_not_passed_through(installed):
+    assert installed({'icon': {'class': 'fas fa-star'}})['icon'] is None