fix: web UI and src.common bugs (wifi wrong-password, plugin icon, starlark toggle, API caching, scroll/logo/font helpers) (#646)

- wifi: keep the "wrong_password:" prefix through the restore/AP fallback so
  the UI's incorrect-password prompt fires again.
- /plugins/installed returns the manifest's icon (string only).
- /starlark/apps/<id>/toggle coerces `enabled` and delegates to
  _toggle_starlark_app (disk before memory, no KeyError, "false" is false).
- /api/v3/ JSON GETs are sent Cache-Control: no-store; non-JSON keeps 5s.
- ScrollHelper.set_scrolling_image converts non-RGB input (alpha onto black);
  create/set_scrolling_image reset last_update_time like reset_scroll.
- LogoHelper backs off a failed download per path for
  MISSING_LOGO_RECHECK_SECONDS; cleared on invalidate/clear_cache.
- refresh_placeholder_timestamp saves atomically.
- FontManager.clear_cache / _clear_plugin_font_cache bump cache_generation.
- Odds manager: per-game logs to DEBUG; JSON decode error caught before
  RequestException (same cooldown).
- element_style mangled continuations; startup validator skips null plugin
  blocks and reuses the controller's discovery.
- src/common/README lists frame_timing, json_body, render_gate.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

test/test_startup_validator.py

@@ -242,6 +242,28 @@ class TestPlugins:
         assert is_valid is True
         assert errors == []
 
+    def test_a_null_plugin_block_does_not_abandon_the_checks(self, good_cache, tmp_path):
+        # config.get(id, {}) returns None for "known": null, and .get() on it
+        # raised -- caught as "Could not validate plugins", skipping every
+        # plugin after it.
+        pm = MagicMock()
+        pm.discover_plugins.return_value = ['nulled', 'known']
+        plugin_dir = tmp_path / "known"
+        plugin_dir.mkdir()  # no manifest.json
+        pm.get_plugin_directory.return_value = str(plugin_dir)
+
+        config = dict(GOOD_CONFIG, nulled=None, known={'enabled': True})
+        validator = StartupValidator(make_config_manager(config), pm)
+        validator._validate_plugins()
+        assert not any('Could not validate plugins' in w for w in validator.warnings)
+        assert "Plugin 'known' manifest.json not found" in validator.errors
+
+    def test_a_passed_discovery_is_reused(self, good_cache):
+        pm = MagicMock()
+        validator = StartupValidator(make_config_manager(dict(GOOD_CONFIG)), pm)
+        validator._validate_plugins(discovered_plugins=[])
+        pm.discover_plugins.assert_not_called()
+
 
 class TestIdempotence:
     """validate_all() resets error/warning state each run (the fixed bug)."""