feat(starlark): implement schema extraction, asset download, and config persistence

## Schema Extraction
- Replace broken `pixlet serve --print-schema` with regex-based source parser
- Extract schema by parsing `get_schema()` function from .star files
- Support all field types: Location, Text, Toggle, Dropdown, Color, DateTime
- Handle variable-referenced dropdown options (e.g., `options = teamOptions`)
- Gracefully handle complex/unsupported field types (OAuth2, PhotoSelect, etc.)
- Extract schema for 90%+ of Tronbyte apps

## Asset Download
- Add `download_app_assets()` to fetch images/, sources/, fonts/ directories
- Download assets in binary mode for proper image/font handling
- Validate all paths to prevent directory traversal attacks
- Copy asset directories during app installation
- Enable apps like AnalogClock that require image assets

## Config Persistence
- Create config.json file during installation with schema defaults
- Update both config.json and manifest when saving configuration
- Load config from config.json (not manifest) for consistency with plugin
- Separate timing keys (render_interval, display_duration) from app config
- Fix standalone web service mode to read/write config.json

## Pixlet Command Fix
- Fix Pixlet CLI invocation: config params are positional, not flags
- Change from `pixlet render file.star -c key=value` to `pixlet render file.star key=value -o output`
- Properly handle JSON config values (e.g., location objects)
- Enable config to be applied during rendering

## Security & Reliability
- Add threading.Lock for cache operations to prevent race conditions
- Reduce ThreadPoolExecutor workers from 20 to 5 for Raspberry Pi
- Add path traversal validation in download_star_file()
- Add YAML error logging in manifest fetching
- Add file size validation (5MB limit) for .star uploads
- Use sanitized app_id consistently in install endpoints
- Use atomic manifest updates to prevent race conditions
- Add missing Optional import for type hints

## Web UI
- Fix standalone mode schema loading in config partial
- Schema-driven config forms now render correctly for all apps
- Location fields show lat/lng/timezone inputs
- Dropdown, toggle, text, color, and datetime fields all supported

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

plugin-repos/starlark-apps/pixlet_renderer.py

@@ -239,16 +239,15 @@ class PixletRenderer:
             return False, f"Star file not found: {star_file}"
 
         try:
-            # Build command
+            # Build command - config params must be POSITIONAL between star_file and flags
+            # Format: pixlet render <file.star> [key=value]... [flags]
             cmd = [
                 self.pixlet_binary,
                 "render",
-                star_file,
-                "-o", output_path,
-                "-m", str(magnify)
+                star_file
             ]
 
-            # Add configuration parameters
+            # Add configuration parameters as positional arguments (BEFORE flags)
             if config:
                 for key, value in config.items():
                     # Validate key format (alphanumeric + underscore only)
@@ -259,6 +258,9 @@ class PixletRenderer:
                     # Convert value to string for CLI
                     if isinstance(value, bool):
                         value_str = "true" if value else "false"
+                    elif isinstance(value, str) and (value.startswith('{') or value.startswith('[')):
+                        # JSON string - keep as-is, will be properly quoted by subprocess
+                        value_str = value
                     else:
                         value_str = str(value)
 
@@ -268,7 +270,14 @@ class PixletRenderer:
                         logger.warning(f"Skipping config value with unsafe characters for key {key}: {value_str}")
                         continue
 
-                    cmd.extend(["-c", f"{key}={value_str}"])
+                    # Add as positional argument (not -c flag)
+                    cmd.append(f"{key}={value_str}")
+
+            # Add flags AFTER positional config arguments
+            cmd.extend([
+                "-o", output_path,
+                "-m", str(magnify)
+            ])
 
             logger.debug(f"Executing Pixlet: {' '.join(cmd)}")