fix: remove content accidentally bundled into the dead-code-removal commit

The previous commit's git add/commit swept in a lot of unrelated,
unreviewed work alongside the intended dead-code deletions: a new Plugin
Composer web UI, new security-audit/CI tooling, a new march-madness
plugin, and 23 local-development-only symlinks under plugin-repos/ (per
scripts/setup_plugin_repos.py's own docstring, these are meant to be
generated locally, never committed -- .gitignore has no entry for them,
which is how they slipped in).

Removed here, split into their own PRs instead (except plugin-repos/*
symlinks and march-madness/ncaa_logos, which are dropped rather than
carried forward -- see PR discussion):
- web_interface/blueprints/composer.py + composer-app.js +
  composer-canvas.js + composer.html + manager.py.j2
- scripts/prove_security.py, audit_plugins.py, generate_report.py
- .github/workflows/security-audit.yml, .github/workflows/tests.yml,
  bandit.yaml
- All plugin-repos/* symlinks (local dev artifacts, not meant to be
  committed at all)
- plugin-repos/march-madness/* and the 4 new assets/sports/ncaa_logos/*
  PNGs it needed (left out of every split PR pending a decision on
  whether march-madness belongs in the core repo or the plugin monorepo)

This PR now contains only what its title describes: the dead-code
removal from the previous commit, untouched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEZK1P1Q1fu5pcuVrkrCFZ

.github/workflows/security-audit.yml

@@ -1,277 +0,0 @@
-name: Security Audit
-
-on:
-  push:
-    branches:
-      - main
-      - 'feat/**'
-  pull_request:
-    branches:
-      - main
-  schedule:
-    # Weekly full scan — catches new CVEs in existing deps
-    - cron: '0 6 * * 1'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pull-requests: write
-  security-events: write
-
-jobs:
-
-  # ─────────────────────────────────────────────────────────────────────────
-  # SAST — Static Application Security Testing
-  # ─────────────────────────────────────────────────────────────────────────
-  sast:
-    name: Static Analysis (bandit + semgrep)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: Install SAST tools
-        run: pip install bandit==1.8.3 semgrep
-
-      # Bandit — Python-specific security linter
-      # --exit-zero: findings are warnings, not CI blockers.
-      # The security-report job interprets severity.
-      - name: Run bandit
-        run: |
-          bandit -r src/ web_interface/ \
-            -c bandit.yaml \
-            -f json \
-            -o bandit-results.json \
-            --exit-zero
-
-      # Semgrep — broader pattern-based analysis
-      # || true: prevents network/rate-limit errors from blocking the workflow
-      - name: Run semgrep
-        run: |
-          semgrep --config "p/python" \
-            --config "p/flask" \
-            --json \
-            --output semgrep-results.json \
-            src/ web_interface/ \
-            || true
-
-      - name: Upload SAST artifacts
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: sast-results
-          path: |
-            bandit-results.json
-            semgrep-results.json
-          retention-days: 30
-
-
-  # ─────────────────────────────────────────────────────────────────────────
-  # Dependency Vulnerability Scanning
-  # ─────────────────────────────────────────────────────────────────────────
-  dependency-audit:
-    name: Dependency Audit (pip-audit + safety)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: Install audit tools
-        run: pip install pip-audit safety
-
-      # Install project deps. Hardware-specific packages (rgbmatrix) will fail
-      # to build on Ubuntu runners — || true handles this gracefully.
-      # pip-audit operates on installed packages; partial install is acceptable.
-      - name: Install project dependencies
-        run: |
-          pip install -r requirements.txt || true
-          pip install -r web_interface/requirements.txt || true
-          pip install -r requirements-emulator.txt || true
-
-      - name: Run pip-audit
-        run: |
-          pip-audit --format json --output pip-audit-results.json || true
-
-      - name: Run safety check
-        run: |
-          safety check --output json > safety-results.json 2>&1 || true
-
-      - name: Upload dependency audit artifacts
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: dependency-audit-results
-          path: |
-            pip-audit-results.json
-            safety-results.json
-          retention-days: 30
-
-
-  # ─────────────────────────────────────────────────────────────────────────
-  # Secrets Detection
-  # ─────────────────────────────────────────────────────────────────────────
-  secrets-scan:
-    name: Secrets Scan (gitleaks)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0  # Full history for scanning all commits
-
-      # continue-on-error: config/config_secrets.template.json contains
-      # placeholder strings (YOUR_*) that may trigger gitleaks rules.
-      # The generate_report.py script suppresses these false positives.
-      - name: Run gitleaks
-        uses: gitleaks/gitleaks-action@v2
-        continue-on-error: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload secrets scan artifacts
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: secrets-scan-results
-          path: results.sarif
-          retention-days: 30
-
-
-  # ─────────────────────────────────────────────────────────────────────────
-  # LEDMatrix-Specific Security Proofs
-  # ─────────────────────────────────────────────────────────────────────────
-  ledmatrix-security-proofs:
-    name: LEDMatrix Security Proofs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: Install dependencies
-        run: pip install -r requirements.txt || true
-
-      # Script exits 1 only on CRITICAL findings.
-      # Warnings are reported but do not block the workflow.
-      - name: Run security proofs
-        run: |
-          python scripts/prove_security.py \
-            --output security-proofs-results.json \
-            --verbose
-
-      - name: Upload proofs artifacts
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: security-proofs-results
-          path: security-proofs-results.json
-          retention-days: 30
-
-
-  # ─────────────────────────────────────────────────────────────────────────
-  # Plugin Security Audit
-  # ─────────────────────────────────────────────────────────────────────────
-  plugin-audit:
-    name: Plugin Security Audit
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      # Script exits 1 only on CRITICAL findings (eval/exec in plugins).
-      # Missing manifest.json etc are warnings.
-      - name: Run plugin audit
-        run: |
-          python scripts/audit_plugins.py \
-            --output plugin-audit-results.json \
-            --verbose
-
-      - name: Upload plugin audit artifacts
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: plugin-audit-results
-          path: plugin-audit-results.json
-          retention-days: 30
-
-
-  # ─────────────────────────────────────────────────────────────────────────
-  # Aggregate Report
-  # ─────────────────────────────────────────────────────────────────────────
-  security-report:
-    name: Security Report
-    runs-on: ubuntu-latest
-    needs:
-      - sast
-      - dependency-audit
-      - secrets-scan
-      - ledmatrix-security-proofs
-      - plugin-audit
-    if: always()  # Run even if upstream jobs fail or are skipped
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: audit-artifacts/
-
-      - name: Generate consolidated report
-        run: |
-          python scripts/generate_report.py \
-            --artifact-dir audit-artifacts/ \
-            --output security-report.md \
-            --verbose
-
-      - name: Upload consolidated report
-        uses: actions/upload-artifact@v4
-        with:
-          name: security-report
-          path: security-report.md
-          retention-days: 90
-
-      - name: Comment on PR
-        if: github.event_name == 'pull_request'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const fs = require('fs');
-            const report = fs.readFileSync('security-report.md', 'utf8');
-            // Use sticky comment — update existing comment rather than adding a new one each run
-            const { data: comments } = await github.rest.issues.listComments({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-            });
-            const botComment = comments.find(c =>
-              c.user.type === 'Bot' && c.body.includes('🔒 Security Audit')
-            );
-            if (botComment) {
-              await github.rest.issues.updateComment({
-                comment_id: botComment.id,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: report,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: report,
-              });
-            }

.github/workflows/tests.yml

@@ -1,46 +0,0 @@
-name: Tests
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: pytest (Python ${{ matrix.python-version }})
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ['3.10', '3.11', '3.12']
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-        with:
-          submodules: false  # rgbmatrix submodule not needed in EMULATOR mode
-
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ matrix.python-version }}
-          cache: pip
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements.txt
-          # Optional deps that some test modules import
-          pip install scipy psutil Flask-Limiter
-
-      - name: Run tests
-        env:
-          EMULATOR: "true"
-        run: |
-          pytest \
-            -m "not hardware and not slow" \
-            --tb=short