fix(tools): don't force PIXLET_EDITOR_HOST, and stop hard-assuming the MQTT bridge is uninstalled in tests

CodeRabbit review on #544:
- start_pixlet_editor() unconditionally set PIXLET_EDITOR_HOST=0.0.0.0,
  overriding any operator-configured loopback-only value and always exposing
  the unauthenticated `pixlet serve` dev process on the LAN (CWE-1188). Use
  env.setdefault() so it's only a default; also stop hardcoding 'host' in the
  recorded session state so status reporting matches what was actually used.
- test_tools_sections.js asserted an Install button always renders, which
  assumes the bridge service is never installed on the test/dev host. Branch
  on the same service.installed flag the template itself renders from.

Adds regression coverage in test_starlark_pixlet_routes.py for the
setdefault-vs-override behavior (both the "nothing configured" and
"operator pinned loopback" cases).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S3bPMESe2TfrGvbs1ef9c5

web_interface/blueprints/api_v3.py

@@ -10087,8 +10087,11 @@ def start_pixlet_editor():
         env['PIXLET_EDITOR_PORT'] = str(port)
         env['PIXLET_EDITOR_TIMEOUT'] = str(timeout_s)
         # A browser reaching this endpoint is remote by definition, so the
-        # session has to listen on more than loopback to be usable at all.
-        env['PIXLET_EDITOR_HOST'] = '0.0.0.0'
+        # session needs to listen on more than loopback to be usable at all --
+        # but only as a *default*. An operator who has already set
+        # PIXLET_EDITOR_HOST (e.g. to keep it loopback-only even from the web
+        # UI) must not have that overridden here.
+        env.setdefault('PIXLET_EDITOR_HOST', '0.0.0.0')
 
         log_path = Path(tempfile.gettempdir()) / 'ledmatrix_pixlet_editor.log'
         log_handle = open(log_path, 'w', encoding='utf-8')  # noqa: SIM115 - owned by the child
@@ -10107,7 +10110,7 @@ def start_pixlet_editor():
         now = time.time()
         state = {'pid': process.pid, 'app_id': app_dir.name, 'port': port,
                  'timeout': timeout_s, 'started_at': now, 'deadline': now + timeout_s,
-                 'host': '0.0.0.0', 'log': str(log_path)}
+                 'host': env['PIXLET_EDITOR_HOST'], 'log': str(log_path)}
         try:
             with open(_PIXLET_EDITOR_STATE, 'w', encoding='utf-8') as handle:
                 json.dump(state, handle)