fix(plugin-system): unload/update race, failed-load cleanup, limits validation, schema lookup, install rollback (#653)

* fix(plugin-system): unload/update race, failed-load module cleanup, limits validation, schema lookup, install rollback, op-queue dedupe

- unload_plugin takes the per-plugin lock (5s bounded) before cleanup(),
  and an update() that finishes after its plugin was unloaded no longer
  sets the state back to ENABLED.
- A load that fails after import drops plugin_<id> and its submodules
  and forgets its manager fonts, so a fixed plugin reloads new code.
- Resource limits are validated as non-negative numbers: 400 at
  POST /plugins/limits, bad cached records ignored with one warning.
  Route docstrings note health/metrics reset and limits only change the
  web process's view.
- SchemaManager.get_schema_path resolves each search dir via
  resolve_plugin_dir (manifest id, ledmatrix-<id>) before the literal
  paths; plugins/ still before plugin-repos/. Misses cached 30s and
  logged once at DEBUG.
- install_from_url sets an existing copy aside and restores it if the
  move fails, under the per-plugin reinstall lock.
- Operation queue refuses a second pending op for a plugin and trims
  _operations with history.
- get_vegas_render_width reads display_manager.width first.
- get_logger in store/schema/health/resource/saved_repositories;
  UTF-8 reads in store_manager and state_manager.
- Docs: update_interval precedence (manifest over config) stated where
  users are told to set it in config.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(web): build the limits 400 message from the field name, not an exception

CodeQL flagged str(e) flowing into the response. invalid_limit_field()
returns the offending field without raising, and limits_from_dict uses it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

test/test_base_plugin_vegas_render_width.py

@@ -0,0 +1,48 @@
+"""BasePlugin.get_vegas_render_width reads display_manager.width first.
+
+CLAUDE.md asks plugins to size themselves from ``display_manager.width`` --
+not ``display_manager.matrix.width`` -- because ``matrix`` is None when
+hardware init fails and the property falls back to the canvas size. The base
+class's own helper read ``matrix.width`` first. For the real DisplayManager
+the two agree whenever there is a matrix, so this pins the documented order
+with a display manager where they differ.
+"""
+
+from types import SimpleNamespace
+
+from src.plugin_system.base_plugin import BasePlugin
+
+
+class _Plugin(BasePlugin):
+    def update(self):
+        pass
+
+    def display(self, force_clear=False):
+        pass
+
+
+def _plugin(display_manager):
+    plugin = object.__new__(_Plugin)
+    plugin.display_manager = display_manager
+    return plugin
+
+
+def test_prefers_display_manager_width_over_matrix_width():
+    dm = SimpleNamespace(width=64, matrix=SimpleNamespace(width=128))
+    assert _plugin(dm).get_vegas_render_width() == 64
+
+
+def test_uses_display_manager_width_when_matrix_is_none():
+    dm = SimpleNamespace(width=96, matrix=None)
+    assert _plugin(dm).get_vegas_render_width() == 96
+
+
+def test_falls_back_to_matrix_width_without_a_width():
+    dm = SimpleNamespace(matrix=SimpleNamespace(width=80))
+    assert _plugin(dm).get_vegas_render_width() == 80
+
+
+def test_vegas_request_still_wins():
+    plugin = _plugin(SimpleNamespace(width=192, matrix=None))
+    plugin._vegas_render_width = 100
+    assert plugin.get_vegas_render_width() == 100