fix: web UI and src.common bugs (wifi wrong-password, plugin icon, starlark toggle, API caching, scroll/logo/font helpers) (#646)

- wifi: keep the "wrong_password:" prefix through the restore/AP fallback so
  the UI's incorrect-password prompt fires again.
- /plugins/installed returns the manifest's icon (string only).
- /starlark/apps/<id>/toggle coerces `enabled` and delegates to
  _toggle_starlark_app (disk before memory, no KeyError, "false" is false).
- /api/v3/ JSON GETs are sent Cache-Control: no-store; non-JSON keeps 5s.
- ScrollHelper.set_scrolling_image converts non-RGB input (alpha onto black);
  create/set_scrolling_image reset last_update_time like reset_scroll.
- LogoHelper backs off a failed download per path for
  MISSING_LOGO_RECHECK_SECONDS; cleared on invalidate/clear_cache.
- refresh_placeholder_timestamp saves atomically.
- FontManager.clear_cache / _clear_plugin_font_cache bump cache_generation.
- Odds manager: per-game logs to DEBUG; JSON decode error caught before
  RequestException (same cooldown).
- element_style mangled continuations; startup validator skips null plugin
  blocks and reuses the controller's discovery.
- src/common/README lists frame_timing, json_body, render_gate.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

test/test_display_controller_startup_validation.py

@@ -25,8 +25,9 @@ class RecordingValidator:
         self.warnings = ['config warning']
         return True, [], list(self.warnings)
 
-    def _validate_plugins(self):
+    def _validate_plugins(self, discovered_plugins=None):
         RecordingValidator.calls.append(('plugins',))
+        RecordingValidator.discovered = discovered_plugins
         self.warnings = ['plugin warning']
 
 
@@ -75,3 +76,19 @@ def test_each_check_runs_once(mock_config_manager, mock_display_manager,
         assert any('plugin warning' in r.getMessage() for r in caplog.records)
     finally:
         controller.cleanup()
+
+
+def test_plugins_are_discovered_once(mock_config_manager, mock_display_manager,
+                                     mock_cache_manager, test_config_with_plugins,
+                                     emulator_mode):
+    """The plugin checks reuse the controller's discovery rather than rescanning
+    the plugins directory (and logging every plugin) a second time."""
+    RecordingValidator.calls = []
+    RecordingValidator.discovered = None
+    controller = _build_controller(mock_config_manager, mock_display_manager,
+                                   mock_cache_manager, test_config_with_plugins)
+    try:
+        assert controller.plugin_manager.discover_plugins.call_count == 1
+        assert RecordingValidator.discovered == []
+    finally:
+        controller.cleanup()