fix(plugin-system): unload/update race, failed-load cleanup, limits validation, schema lookup, install rollback (#653)

* fix(plugin-system): unload/update race, failed-load module cleanup, limits validation, schema lookup, install rollback, op-queue dedupe

- unload_plugin takes the per-plugin lock (5s bounded) before cleanup(),
  and an update() that finishes after its plugin was unloaded no longer
  sets the state back to ENABLED.
- A load that fails after import drops plugin_<id> and its submodules
  and forgets its manager fonts, so a fixed plugin reloads new code.
- Resource limits are validated as non-negative numbers: 400 at
  POST /plugins/limits, bad cached records ignored with one warning.
  Route docstrings note health/metrics reset and limits only change the
  web process's view.
- SchemaManager.get_schema_path resolves each search dir via
  resolve_plugin_dir (manifest id, ledmatrix-<id>) before the literal
  paths; plugins/ still before plugin-repos/. Misses cached 30s and
  logged once at DEBUG.
- install_from_url sets an existing copy aside and restores it if the
  move fails, under the per-plugin reinstall lock.
- Operation queue refuses a second pending op for a plugin and trims
  _operations with history.
- get_vegas_render_width reads display_manager.width first.
- get_logger in store/schema/health/resource/saved_repositories;
  UTF-8 reads in store_manager and state_manager.
- Docs: update_interval precedence (manifest over config) stated where
  users are told to set it in config.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(web): build the limits 400 message from the field name, not an exception

CodeQL flagged str(e) flowing into the response. invalid_limit_field()
returns the offending field without raising, and limits_from_dict uses it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

test/test_operation_queue_pending_and_trim.py

@@ -0,0 +1,71 @@
+"""PluginOperationQueue refuses a second queued op per plugin and stays bounded.
+
+enqueue_operation only checked _active_operations, which holds the operation
+that is *running*. While a plugin's first operation still waited in the queue
+(the worker busy with another plugin), a second one for the same plugin was
+accepted and both ran back to back. And _operations kept every operation ever
+enqueued, although the history beside it was trimmed to max_history.
+"""
+
+import threading
+import time
+
+import pytest
+
+from src.plugin_system.operation_queue import PluginOperationQueue
+from src.plugin_system.operation_types import OperationStatus, OperationType
+
+
+@pytest.fixture
+def op_queue():
+    q = PluginOperationQueue(max_history=3)
+    yield q
+    q.shutdown()
+
+
+def _wait_for(predicate, timeout=5.0):
+    deadline = time.monotonic() + timeout
+    while not predicate() and time.monotonic() < deadline:
+        time.sleep(0.01)
+    return predicate()
+
+
+def test_second_pending_operation_for_a_plugin_is_refused(op_queue):
+    release = threading.Event()
+    started = threading.Event()
+
+    def blocker(op):
+        started.set()
+        release.wait(5)
+        return {"success": True}
+
+    op_queue.enqueue_operation(OperationType.INSTALL, "busy", operation_callback=blocker)
+    assert started.wait(5)
+
+    first = op_queue.enqueue_operation(
+        OperationType.INSTALL, "demo", operation_callback=lambda op: {"success": True})
+    assert op_queue.get_operation_status(first).status == OperationStatus.PENDING
+
+    with pytest.raises(ValueError, match="already has an active operation"):
+        op_queue.enqueue_operation(
+            OperationType.INSTALL, "demo", operation_callback=lambda op: {"success": True})
+
+    release.set()
+    assert _wait_for(lambda: op_queue.get_operation_status(first).status
+                     == OperationStatus.COMPLETED)
+    # Once it has finished, the plugin accepts a new operation again.
+    op_queue.enqueue_operation(OperationType.UPDATE, "demo")
+
+
+def test_operations_map_is_trimmed_with_history(op_queue):
+    ids = [op_queue.enqueue_operation(OperationType.INSTALL, f"p{i}",
+                                      operation_callback=lambda op: {"success": True})
+           for i in range(8)]
+    assert _wait_for(lambda: all(
+        (op_queue.get_operation_status(i) is None
+         or op_queue.get_operation_status(i).status == OperationStatus.COMPLETED)
+        for i in ids) and len(op_queue.get_operation_history()) == 3)
+
+    assert len(op_queue._operations) == 3
+    kept = {op.operation_id for op in op_queue.get_operation_history()}
+    assert set(op_queue._operations) == kept