refactor: delete dead Python code in the core (and stop storing Wi-Fi passwords) (#608)

* refactor(plugins): remove the no-op PluginHealthMonitor

Its monitor loop did nothing (`if callbacks: pass`), register_health_check
had no callers and api_v3.health_monitor was never read by any route. The
live health data comes from PluginHealthTracker, which is untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(store): drop the never-set uninstall tombstones

Nothing in production called mark_recently_uninstalled, so the
reconciler's was_recently_uninstalled check was always False. The
persistent uninstall registry is what actually stops resurrection; the
reconciler test now exercises that gate instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(common): delete unused config/display/game helpers, utils and error_handler

Nothing in core, the web UI, scripts or the plugin monorepo imports
config_helper, display_helper, game_helper, utils or error_handler; only
their own tests did. The error_handler re-exports leave src.common's
__all__; APIHelper, TextHelper, ScrollHelper, LogoHelper and the adaptive
layout exports are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(config): drop ConfigService's unused versioning and save API

ConfigVersion, get_version/get_version_history/get_version_config,
rollback, save_config, reload, get_plugin_config and the backward-compat
load_config/get_config_path/get_secrets_path had no callers. The display
controller only uses get_config, subscribe, unsubscribe and shutdown,
plus the file watcher. Change detection now compares against the
current checksum instead of the last history entry.

The subscriber tests asserted `callback.called or True`; they now
reload the way the watcher does and assert the notification.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(plugins): drop unread plugin state history and callbacks

plugin_state.PluginStateManager kept a bounded per-plugin transition
history that only get_state_history (tests only) read; get_state_info
reports a separate lifetime count, which stays. set_error_info and
record_display had no callers, and set_state_with_error's `error`
argument only fed the history.

The web-side state_manager.PluginStateManager loses
subscribe_to_state_changes, _notify_callbacks, set_plugin_error and
get_state_version, none of which had callers; with no subscribers the
old-state copy in update_plugin_state went with them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(plugins): remove unused PluginManager methods and attribute guards

update_all_plugins was only called by a test (the display loop uses
run_scheduled_updates); get_plugin_health_metrics,
get_plugin_resource_metrics and get_plugin_state had no callers; and
plugin_modules was written but never read. plugin_directories is now
initialised in __init__, so the hasattr() guards around it go.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(plugins): remove unused executor, loader, store and package helpers

- PluginExecutor.execute_safe: no callers.
- PluginLoader._parse_semver: only its own tests; compatibility.parse_semver
  is the live copy and test_compatibility.py already covers it.
- PluginStoreManager.get_installed_plugin_info: no callers.
- PluginResourceMonitor._local: never read.
- src.plugin_system.get_store_manager and __api_version__: no importers in
  core, scripts or the plugin monorepo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(wifi): stop storing Wi-Fi passwords in wifi_config.json

WiFiManager appended every joined network's SSID and password, in
plaintext, to saved_networks in config/wifi_config.json, and nothing
(web UI, backup restore, scripts) ever read them back: NetworkManager
keeps its own credentials. The writes are gone, and loading the config
now drops any saved_networks key and rewrites the file, so passwords
already on disk are scrubbed.

Also removes _check_dnsmasq_conflict (never called) and _detect_trixie,
whose result only reached one log line, along with the
NM_CONNECTIONS_PATHS constant only it used.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(display): remove unreachable and unused DisplayController code

- _follower_rebuild_scroll_image: never called.
- mode_duration (never read) and last_mode_change (write-only).
- The `chosen_cap <= 0` branch: chosen_cap is either the minimum of
  caps already filtered to > 0 or DEFAULT_DYNAMIC_DURATION_CAP (180).
- The `max_duration < min_duration` branch directly after
  `max_duration = max(min_duration, max_duration)`.
- The circuit-breaker branch's `display_result = False` and
  `manager_to_display = None`: the first is overwritten a few lines
  later, the second is already None there.
- The bool-to-bool conversion of execute_display's result, which is
  always a bool.
- The `loaded_plugins` lookup in _update_modules: PluginManager has no
  such attribute, so it always fell through to `plugins`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(vegas): remove unused config update, boundary finder and refresh

VegasModeConfig.update had no callers outside its own tests (the
coordinator rebuilds the config with from_config on a change);
geometry.find_item_boundary and StreamManager._refresh_plugin_content
had no callers at all.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(run): drop the debug block that pretended to import the plugin system

In debug mode run.py put src/plugin_system itself on sys.path and printed
"Plugin system import successful" without importing anything. Nothing
imports plugin_system modules by bare name, so the path entry did
nothing either.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test: delete tests that test nothing

- test/plugins/test_{basketball_scoreboard,calendar,clock_simple,
  odds_ticker,soccer_scoreboard,text_display}.py skip everywhere the named
  plugins are not installed, including CI (LEDMATRIX_PLUGINS_DIR holds only
  the fixture plugin); test_plugin_matrix.py already covers every
  discovered plugin. Their PluginTestBase and the fixtures only it used
  (plugins_dir, mock_display_manager, mock_cache_manager,
  mock_plugin_manager, base_plugin_config in test/plugins/conftest.py) go
  with them.
- test_plugin_system.py: test_discover_plugins (body was `pass`) and
  test_dependency_check (a comment), plus the test_plugin_manager fixture
  only the former requested.
- test_display_manager.py: test_draw_image asserted that an image it had
  just assigned was not None.
- test_display_controller.py: the rotation and schedule-override tests
  re-implemented the run-loop arithmetic inline and asserted on their own
  result without calling the controller.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test: expect one plugin_last_update success stamp after update_all_plugins

EveryStampRecordsACompletion required at least two success-path stamps;
the second was update_all_plugins, removed as test-only. The worker and
synchronous paths share the remaining stamp in _execute_update_now, and
the check that every stamp calls _note_update_completed is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

test/test_wifi_manager_ap.py

@@ -10,6 +10,7 @@ Scenarios covered:
 3. iptables rules and ip_forward are reverted when the AP is torn down.
 4. LED matrix message includes the SSID, 'No password', and the setup URL.
 5. Known AP profile names are deleted before the new profile is created.
+6. Wi-Fi passwords are not written to wifi_config.json, and old ones are scrubbed.
 """
 from __future__ import annotations
 
@@ -62,7 +63,6 @@ def wifi_config(tmp_path: Path) -> Path:
         "ap_ssid": "LEDMatrix-Setup",
         "ap_channel": 7,
         "auto_enable_ap_mode": True,
-        "saved_networks": [],
     }
     p = cfg_dir / "wifi_config.json"
     p.write_text(json.dumps(cfg))
@@ -75,8 +75,7 @@ def manager(wifi_config: Path, tmp_path: Path) -> WiFiManager:
     WiFiManager with all system calls stubbed out during construction and the
     ip_forward save file redirected to a per-test temporary path.
     """
-    with patch("src.wifi_manager.subprocess.run", return_value=_ok(stdout="wlan0\n")), \
-         patch.object(WiFiManager, "_detect_trixie", return_value=False):
+    with patch("src.wifi_manager.subprocess.run", return_value=_ok(stdout="wlan0\n")):
         mgr = WiFiManager(config_path=wifi_config)
 
     # Force clean, deterministic state regardless of what __init__ inferred
@@ -85,7 +84,6 @@ def manager(wifi_config: Path, tmp_path: Path) -> WiFiManager:
     mgr.has_hostapd = False
     mgr.has_dnsmasq = False
     mgr.has_iwlist = False
-    mgr._is_trixie = False
     # Redirect the ip_forward save file to tmp so tests never share state
     mgr._IP_FORWARD_SAVE_PATH = tmp_path / "ip_fwd_saved"
     return mgr
@@ -332,3 +330,62 @@ def test_existing_ap_profiles_deleted_before_new_profile_created(manager: WiFiMa
     assert del_indices, "Expected 'nmcli connection delete' calls"
     assert max(del_indices) < min(add_indices), \
         "All connection deletions must complete before the new profile is created"
+
+
+# ---------------------------------------------------------------------------
+# 6. Wi-Fi passwords are not kept in wifi_config.json
+# ---------------------------------------------------------------------------
+
+@pytest.mark.unit
+def test_loading_scrubs_plaintext_saved_networks(wifi_config: Path) -> None:
+    """Older versions wrote every joined network's password to the config in
+    plaintext and never read it back. Loading must remove it from disk."""
+    cfg = json.loads(wifi_config.read_text())
+    cfg["saved_networks"] = [
+        {"ssid": "HomeNet", "password": "hunter22", "saved_at": 0},
+    ]
+    wifi_config.write_text(json.dumps(cfg))
+
+    with patch("src.wifi_manager.subprocess.run", return_value=_ok(stdout="wlan0\n")):
+        mgr = WiFiManager(config_path=wifi_config)
+
+    assert "saved_networks" not in mgr.config
+    assert "hunter22" not in wifi_config.read_text()
+    on_disk = json.loads(wifi_config.read_text())
+    assert "saved_networks" not in on_disk
+    # Everything else survives the scrub.
+    assert on_disk["ap_ssid"] == "LEDMatrix-Setup"
+    assert on_disk["auto_enable_ap_mode"] is True
+
+
+@pytest.mark.unit
+def test_default_config_has_no_saved_networks(tmp_path: Path) -> None:
+    config_path = tmp_path / "config" / "wifi_config.json"
+    config_path.parent.mkdir()
+
+    with patch("src.wifi_manager.subprocess.run", return_value=_ok(stdout="wlan0\n")):
+        WiFiManager(config_path=config_path)
+
+    assert "saved_networks" not in json.loads(config_path.read_text())
+
+
+@pytest.mark.unit
+def test_connecting_does_not_store_the_password(manager: WiFiManager) -> None:
+    commands = []
+
+    def fake_run(cmd, *args, **kwargs):
+        commands.append(cmd)
+        # No existing profile for the SSID, so a new connection is created.
+        if cmd[:3] == ["nmcli", "connection", "show"] and "HomeNet" in cmd:
+            return _fail()
+        return _ok(stdout="")
+
+    with patch("src.wifi_manager.subprocess.run", side_effect=fake_run), \
+         patch("src.wifi_manager.time.sleep"), \
+         patch.object(manager, "_show_led_message"):
+        manager._connect_nmcli("HomeNet", "hunter22")
+
+    assert ["nmcli", "device", "wifi", "connect", "HomeNet", "password", "hunter22"] in commands, \
+        "the new-connection path was not reached"
+    assert "hunter22" not in json.dumps(manager.config)
+    assert "hunter22" not in manager.config_path.read_text()