fix(plugin-system): unload/update race, failed-load cleanup, limits validation, schema lookup, install rollback (#653)

* fix(plugin-system): unload/update race, failed-load module cleanup, limits validation, schema lookup, install rollback, op-queue dedupe

- unload_plugin takes the per-plugin lock (5s bounded) before cleanup(),
  and an update() that finishes after its plugin was unloaded no longer
  sets the state back to ENABLED.
- A load that fails after import drops plugin_<id> and its submodules
  and forgets its manager fonts, so a fixed plugin reloads new code.
- Resource limits are validated as non-negative numbers: 400 at
  POST /plugins/limits, bad cached records ignored with one warning.
  Route docstrings note health/metrics reset and limits only change the
  web process's view.
- SchemaManager.get_schema_path resolves each search dir via
  resolve_plugin_dir (manifest id, ledmatrix-<id>) before the literal
  paths; plugins/ still before plugin-repos/. Misses cached 30s and
  logged once at DEBUG.
- install_from_url sets an existing copy aside and restores it if the
  move fails, under the per-plugin reinstall lock.
- Operation queue refuses a second pending op for a plugin and trims
  _operations with history.
- get_vegas_render_width reads display_manager.width first.
- get_logger in store/schema/health/resource/saved_repositories;
  UTF-8 reads in store_manager and state_manager.
- Docs: update_interval precedence (manifest over config) stated where
  users are told to set it in config.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(web): build the limits 400 message from the field name, not an exception

CodeQL flagged str(e) flowing into the response. invalid_limit_field()
returns the offending field without raising, and limits_from_dict uses it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

src/plugin_system/base_plugin.py

@@ -776,28 +776,35 @@ class BasePlugin(ABC):
         tighter arrangement instead of being cropped afterwards.
 
         Vegas also narrows ``display_manager`` for the duration of the call, so
-        a plugin that already sizes itself from ``matrix.width`` needs no
-        changes. Read this only when you size content some other way.
+        a plugin that already sizes itself from ``display_manager.width`` needs
+        no changes. Read this only when you size content some other way.
 
         Controlled by the plugin's own ``vegas_width_pct`` config value, else
         the global ``display.vegas_scroll.render_width_pct``.
 
         Returns:
             Target width in pixels. Outside a Vegas content request, the full
-            display width.
+            display width: ``display_manager.width``, which falls back to the
+            canvas size when ``matrix`` is None (hardware init failed).
         """
         requested = getattr(self, '_vegas_render_width', None)
         if isinstance(requested, int) and requested > 0:
             return requested
 
+        # display_manager.width first, as CLAUDE.md asks of every plugin: it
+        # already reads matrix.width when there is a matrix. matrix.width is
+        # only the fallback for a display_manager without a width (a test
+        # double, an older wrapper).
         display_manager = getattr(self, 'display_manager', None)
-        matrix = getattr(display_manager, 'matrix', None)
-        if matrix is not None and getattr(matrix, 'width', None):
-            return int(matrix.width)
         width = getattr(display_manager, 'width', None)
         if callable(width):
             width = width()
-        return int(width) if width else 128
+        if width:
+            return int(width)
+        matrix = getattr(display_manager, 'matrix', None)
+        if matrix is not None and getattr(matrix, 'width', None):
+            return int(matrix.width)
+        return 128
 
     def get_vegas_content(self) -> Optional[Any]:
         """