refactor: delete dead Python code in the core (and stop storing Wi-Fi passwords) (#608)

* refactor(plugins): remove the no-op PluginHealthMonitor

Its monitor loop did nothing (`if callbacks: pass`), register_health_check
had no callers and api_v3.health_monitor was never read by any route. The
live health data comes from PluginHealthTracker, which is untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(store): drop the never-set uninstall tombstones

Nothing in production called mark_recently_uninstalled, so the
reconciler's was_recently_uninstalled check was always False. The
persistent uninstall registry is what actually stops resurrection; the
reconciler test now exercises that gate instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(common): delete unused config/display/game helpers, utils and error_handler

Nothing in core, the web UI, scripts or the plugin monorepo imports
config_helper, display_helper, game_helper, utils or error_handler; only
their own tests did. The error_handler re-exports leave src.common's
__all__; APIHelper, TextHelper, ScrollHelper, LogoHelper and the adaptive
layout exports are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(config): drop ConfigService's unused versioning and save API

ConfigVersion, get_version/get_version_history/get_version_config,
rollback, save_config, reload, get_plugin_config and the backward-compat
load_config/get_config_path/get_secrets_path had no callers. The display
controller only uses get_config, subscribe, unsubscribe and shutdown,
plus the file watcher. Change detection now compares against the
current checksum instead of the last history entry.

The subscriber tests asserted `callback.called or True`; they now
reload the way the watcher does and assert the notification.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(plugins): drop unread plugin state history and callbacks

plugin_state.PluginStateManager kept a bounded per-plugin transition
history that only get_state_history (tests only) read; get_state_info
reports a separate lifetime count, which stays. set_error_info and
record_display had no callers, and set_state_with_error's `error`
argument only fed the history.

The web-side state_manager.PluginStateManager loses
subscribe_to_state_changes, _notify_callbacks, set_plugin_error and
get_state_version, none of which had callers; with no subscribers the
old-state copy in update_plugin_state went with them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(plugins): remove unused PluginManager methods and attribute guards

update_all_plugins was only called by a test (the display loop uses
run_scheduled_updates); get_plugin_health_metrics,
get_plugin_resource_metrics and get_plugin_state had no callers; and
plugin_modules was written but never read. plugin_directories is now
initialised in __init__, so the hasattr() guards around it go.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(plugins): remove unused executor, loader, store and package helpers

- PluginExecutor.execute_safe: no callers.
- PluginLoader._parse_semver: only its own tests; compatibility.parse_semver
  is the live copy and test_compatibility.py already covers it.
- PluginStoreManager.get_installed_plugin_info: no callers.
- PluginResourceMonitor._local: never read.
- src.plugin_system.get_store_manager and __api_version__: no importers in
  core, scripts or the plugin monorepo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(wifi): stop storing Wi-Fi passwords in wifi_config.json

WiFiManager appended every joined network's SSID and password, in
plaintext, to saved_networks in config/wifi_config.json, and nothing
(web UI, backup restore, scripts) ever read them back: NetworkManager
keeps its own credentials. The writes are gone, and loading the config
now drops any saved_networks key and rewrites the file, so passwords
already on disk are scrubbed.

Also removes _check_dnsmasq_conflict (never called) and _detect_trixie,
whose result only reached one log line, along with the
NM_CONNECTIONS_PATHS constant only it used.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(display): remove unreachable and unused DisplayController code

- _follower_rebuild_scroll_image: never called.
- mode_duration (never read) and last_mode_change (write-only).
- The `chosen_cap <= 0` branch: chosen_cap is either the minimum of
  caps already filtered to > 0 or DEFAULT_DYNAMIC_DURATION_CAP (180).
- The `max_duration < min_duration` branch directly after
  `max_duration = max(min_duration, max_duration)`.
- The circuit-breaker branch's `display_result = False` and
  `manager_to_display = None`: the first is overwritten a few lines
  later, the second is already None there.
- The bool-to-bool conversion of execute_display's result, which is
  always a bool.
- The `loaded_plugins` lookup in _update_modules: PluginManager has no
  such attribute, so it always fell through to `plugins`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(vegas): remove unused config update, boundary finder and refresh

VegasModeConfig.update had no callers outside its own tests (the
coordinator rebuilds the config with from_config on a change);
geometry.find_item_boundary and StreamManager._refresh_plugin_content
had no callers at all.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(run): drop the debug block that pretended to import the plugin system

In debug mode run.py put src/plugin_system itself on sys.path and printed
"Plugin system import successful" without importing anything. Nothing
imports plugin_system modules by bare name, so the path entry did
nothing either.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test: delete tests that test nothing

- test/plugins/test_{basketball_scoreboard,calendar,clock_simple,
  odds_ticker,soccer_scoreboard,text_display}.py skip everywhere the named
  plugins are not installed, including CI (LEDMATRIX_PLUGINS_DIR holds only
  the fixture plugin); test_plugin_matrix.py already covers every
  discovered plugin. Their PluginTestBase and the fixtures only it used
  (plugins_dir, mock_display_manager, mock_cache_manager,
  mock_plugin_manager, base_plugin_config in test/plugins/conftest.py) go
  with them.
- test_plugin_system.py: test_discover_plugins (body was `pass`) and
  test_dependency_check (a comment), plus the test_plugin_manager fixture
  only the former requested.
- test_display_manager.py: test_draw_image asserted that an image it had
  just assigned was not None.
- test_display_controller.py: the rotation and schedule-override tests
  re-implemented the run-loop arithmetic inline and asserted on their own
  result without calling the controller.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test: expect one plugin_last_update success stamp after update_all_plugins

EveryStampRecordsACompletion required at least two success-path stamps;
the second was update_all_plugins, removed as test-only. The worker and
synchronous paths share the remaining stamp in _execute_update_now, and
the check that every stamp calls _note_update_completed is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

test/test_store_manager_caches.py

@@ -1,10 +1,8 @@
 """
-Tests for the caching and tombstone behaviors added to PluginStoreManager
-to fix the plugin-list slowness and the uninstall-resurrection bugs.
+Tests for the caching behaviors added to PluginStoreManager to fix the
+plugin-list slowness and the uninstall-resurrection bugs.
 
 Coverage targets:
-- ``mark_recently_uninstalled`` / ``was_recently_uninstalled`` lifecycle and
-  TTL expiry.
 - ``_get_local_git_info`` mtime-gated cache: ``git`` subprocesses only run
   when ``.git/HEAD`` mtime changes.
 - ``fetch_registry`` stale-cache fallback on network failure.
@@ -20,29 +18,6 @@ from unittest.mock import patch, MagicMock
 from src.plugin_system.store_manager import PluginStoreManager
 
 
-class TestUninstallTombstone(unittest.TestCase):
-    def setUp(self):
-        self._tmp = TemporaryDirectory()
-        self.addCleanup(self._tmp.cleanup)
-        self.sm = PluginStoreManager(plugins_dir=self._tmp.name)
-
-    def test_unmarked_plugin_is_not_recent(self):
-        self.assertFalse(self.sm.was_recently_uninstalled("foo"))
-
-    def test_marking_makes_it_recent(self):
-        self.sm.mark_recently_uninstalled("foo")
-        self.assertTrue(self.sm.was_recently_uninstalled("foo"))
-
-    def test_tombstone_expires_after_ttl(self):
-        self.sm._uninstall_tombstone_ttl = 0.05
-        self.sm.mark_recently_uninstalled("foo")
-        self.assertTrue(self.sm.was_recently_uninstalled("foo"))
-        time.sleep(0.1)
-        self.assertFalse(self.sm.was_recently_uninstalled("foo"))
-        # Expired entry should also be pruned from the dict.
-        self.assertNotIn("foo", self.sm._uninstall_tombstones)
-
-
 class TestPersistentUninstallRegistry(unittest.TestCase):
     """Regression tests for the persistent uninstall registry that stops a
     core `git pull` update from resurrecting built-in plugins the user
@@ -590,18 +565,13 @@ class TestStaleOnErrorFallbacks(unittest.TestCase):
 
 
 class TestInstallUpdateUninstallInvariants(unittest.TestCase):
-    """Regression guard: the caching and tombstone work added in this PR
-    must not break the install / update / uninstall code paths.
+    """Regression guard: the caching work added in this PR must not break
+    the install / update / uninstall code paths.
 
     Specifically:
     - ``install_plugin`` bypasses commit/manifest caches via force_refresh,
       so the 5→30 min TTL bump cannot cause users to install a stale commit.
     - ``update_plugin`` does the same.
-    - The uninstall tombstone is only honored by the state reconciler, not
-      by explicit ``install_plugin`` calls — so a user can uninstall and
-      immediately reinstall from the store UI without the tombstone getting
-      in the way.
-    - ``was_recently_uninstalled`` is not touched by ``install_plugin``.
     """
 
     def setUp(self):
@@ -649,10 +619,8 @@ class TestInstallUpdateUninstallInvariants(unittest.TestCase):
         self.assertTrue(manifest_calls, "manifest fetch was not called")
         self.assertTrue(manifest_calls[0][3], "force_refresh=True did not reach _fetch_manifest_from_github")
 
-    def test_install_plugin_is_not_blocked_by_tombstone(self):
-        """A tombstone must only gate the reconciler, not explicit installs.
-
-        Uses a complete, valid manifest stub and a no-op dependency
+    def test_install_plugin_runs_to_completion(self):
+        """Uses a complete, valid manifest stub and a no-op dependency
         installer so ``install_plugin`` runs all the way through to a
         True return. Anything less (e.g. swallowing exceptions) would
         hide real regressions in the install path.
@@ -664,11 +632,6 @@ class TestInstallUpdateUninstallInvariants(unittest.TestCase):
         }
         self.sm.registry_cache_time = time.time()
 
-        # Mark it recently uninstalled (simulates a user who just clicked
-        # uninstall and then immediately clicked install again).
-        self.sm.mark_recently_uninstalled("bar")
-        self.assertTrue(self.sm.was_recently_uninstalled("bar"))
-
         # Stub the heavy bits so install_plugin can run without network.
         self.sm._get_github_repo_info = lambda url: {
             "default_branch": "main", "stars": 0,
@@ -701,17 +664,14 @@ class TestInstallUpdateUninstallInvariants(unittest.TestCase):
 
         self.sm._install_via_git = fake_install_via_git
 
-        # No exception-swallowing: if install_plugin fails for ANY reason
-        # unrelated to the tombstone, the test fails loudly.
+        # No exception-swallowing: if install_plugin fails for ANY reason,
+        # the test fails loudly.
         result = self.sm.install_plugin("bar")
 
         self.assertTrue(
             result,
-            "install_plugin returned False — the tombstone should not gate "
-            "explicit installs and all other stubs should allow success.",
+            "install_plugin returned False — all stubs should allow success.",
         )
-        # Tombstone survives install (harmless — nothing reads it for installed plugins).
-        self.assertTrue(self.sm.was_recently_uninstalled("bar"))
 
 
 class TestRegistryStaleCacheFallback(unittest.TestCase):