fix(config): Add defaults to schemas and fix config validation issues (#153)

* fix(web): Resolve font display and config API error handling issues

- Fix font catalog display error where path.startsWith fails
  (path is object, not string)
- Update save_main_config to use error_response() helper
- Improve save_raw_main_config error handling consistency
- Add proper error codes and traceback details to API responses

* fix(web): Prevent fontCatalog redeclaration error on HTMX reload

- Use window object to store global font variables
- Check if script has already loaded before declaring variables
- Update both window properties and local references on assignment
- Fixes 'Identifier fontCatalog has already been declared' error

* fix(web): Wrap fonts script in IIFE to prevent all redeclaration errors

- Wrap entire script in IIFE that only runs once
- Check if script already loaded before declaring variables/functions
- Expose initializeFontsTab to window for re-initialization
- Prevents 'Identifier has already been declared' errors on HTMX reload

* fix(web): Exempt config save API endpoints from CSRF protection

- Exempt save_raw_main_config, save_raw_secrets_config, and save_main_config from CSRF
- These endpoints are called via fetch from JavaScript and don't include CSRF tokens
- Fixes 500 error when saving config via raw JSON editor

* fix(web): Exempt system action endpoint from CSRF protection

- Exempt execute_system_action from CSRF
- Fixes 500 error when using system action buttons (restart display, restart Pi, etc.)
- These endpoints are called via HTMX and don't include CSRF tokens

* fix(web): Exempt all API v3 endpoints from CSRF protection

- Add before_request handler to exempt all api_v3.* endpoints
- All API endpoints are programmatic (HTMX/fetch) and don't include CSRF tokens
- Prevents future CSRF errors on any API endpoint
- Cleaner than exempting individual endpoints

* refactor(web): Remove CSRF protection for local-only application

- CSRF is designed for internet-facing apps to prevent cross-site attacks
- For local-only Raspberry Pi app, threat model is different
- All endpoints were exempted anyway, so it wasn't protecting anything
- Forms use HTMX without CSRF tokens
- If exposing to internet later, can re-enable with proper token implementation

* fix(web): Fix font path double-prefixing in font catalog display

- Only prefix with 'assets/fonts/' if path is a bare filename
- If path starts with '/' (absolute) or 'assets/' (already prefixed), use as-is
- Fixes double-prefixing when get_fonts_catalog returns relative paths like 'assets/fonts/press_start.ttf'

* fix(web): Remove fontsTabInitialized guard to allow re-initialization on HTMX reload

- Remove fontsTabInitialized check that prevented re-initialization on HTMX content swap
- The window._fontsScriptLoaded guard is sufficient to prevent function redeclaration
- Allow initializeFontsTab() to run on each HTMX swap to attach listeners to new DOM elements
- Fixes fonts UI breaking after HTMX reload (buttons, upload dropzone, etc. not working)

* fix(api): Preserve empty strings for optional string fields in plugin config

- Add _is_field_required() helper to check if fields are required in schema
- Update _parse_form_value_with_schema() to preserve empty strings for optional string fields
- Fixes 400 error when saving MQTT plugin config with empty username/password
- Resolves validation error: 'Expected type string, got NoneType'

* fix(config): Add defaults to schemas and fix None value handling

- Updated merge_with_defaults to replace None values with defaults
- Fixed form processing to skip empty optional fields without defaults
- Added script to automatically add defaults to all plugin config schemas
- Added defaults to 89 fields across 10 plugin schemas
- Prevents validation errors from None values in configs

Changes:
- schema_manager.py: Enhanced merge_with_defaults to replace None with defaults
- api_v3.py: Added _SKIP_FIELD sentinel to skip optional fields without defaults
- add_defaults_to_schemas.py: Script to add sensible defaults to schemas
- Plugin schemas: Added defaults for number, boolean, and array fields

* fix(config): Fix save button spinner by checking HTTP status code

- Fixed handleConfigSave to check xhr.status instead of event.detail.successful
- With hx-swap="none", HTMX doesn't set event.detail.successful
- Now properly detects successful saves (status 200-299) and stops spinner
- Improved error message extraction from API responses
- Also fixed handleToggleResponse for consistency

---------

Co-authored-by: Chuck <chuck@example.com>

src/plugin_system/schema_manager.py

@@ -394,24 +394,54 @@ class SchemaManager:
     def merge_with_defaults(self, config: Dict[str, Any], defaults: Dict[str, Any]) -> Dict[str, Any]:
         """
         Merge configuration with defaults, preserving user values.
+        Also replaces None values with defaults to ensure config never has None from the start.
         
         Args:
             config: User configuration
             defaults: Default values from schema
             
         Returns:
-            Merged configuration with defaults applied where missing
+            Merged configuration with defaults applied where missing or None
         """
-        merged = defaults.copy()
+        merged = copy.deepcopy(defaults)
         
-        def deep_merge(target: Dict[str, Any], source: Dict[str, Any]) -> None:
-            """Recursively merge source into target."""
+        def deep_merge(target: Dict[str, Any], source: Dict[str, Any], default_dict: Dict[str, Any]) -> None:
+            """Recursively merge source into target, replacing None with defaults."""
             for key, value in source.items():
+                default_value = default_dict.get(key)
+                
                 if key in target and isinstance(target[key], dict) and isinstance(value, dict):
-                    deep_merge(target[key], value)
+                    # Both are dicts, recursively merge
+                    if isinstance(default_value, dict):
+                        deep_merge(target[key], value, default_value)
+                    else:
+                        deep_merge(target[key], value, {})
+                elif value is None and default_value is not None:
+                    # Value is None and we have a default, use the default
+                    target[key] = copy.deepcopy(default_value) if isinstance(default_value, (dict, list)) else default_value
                 else:
-                    target[key] = value
+                    # Normal merge: user value takes precedence (copy if dict/list)
+                    if isinstance(value, (dict, list)):
+                        target[key] = copy.deepcopy(value)
+                    else:
+                        target[key] = value
         
-        deep_merge(merged, config)
+        deep_merge(merged, config, defaults)
+        
+        # Final pass: replace any remaining None values at any level with defaults
+        def replace_none_with_defaults(target: Dict[str, Any], default_dict: Dict[str, Any]) -> None:
+            """Recursively replace None values with defaults."""
+            for key in list(target.keys()):
+                value = target[key]
+                default_value = default_dict.get(key)
+                
+                if value is None and default_value is not None:
+                    # Replace None with default
+                    target[key] = copy.deepcopy(default_value) if isinstance(default_value, (dict, list)) else default_value
+                elif isinstance(value, dict) and isinstance(default_value, dict):
+                    # Recursively process nested dicts
+                    replace_none_with_defaults(value, default_value)
+        
+        replace_none_with_defaults(merged, defaults)
         return merged