Merge main into feat/plugin-composer, and fix three review findings

The branch was 57 commits behind and conflicting. I had put the rebase
aside earlier as needing the author's eyes, on the grounds that the PR is
+5091 lines -- but that was the wrong measure. The actual conflict was a
single hunk in app.css, where this branch adds .md\:inline and main added
.md\:block and .md\:w-auto at the same place. All three are kept.

Merging rather than rebasing: the branch is public and 57 commits behind,
so a rebase would rewrite shared history for a force-push.

Three findings fixed on top:

A missing `text` or `format` was a 500. `p` is a copy of the raw element
and the defaults were applied to the locals t1/fmt1 only, so an element
omitting either key left it absent, manager.py.j2 rendered
`{{ el.text | tojson }}` over a jinja2.Undefined, and tojson raised
TypeError -- which no handler catches:

    text without 'text':    TypeError: Object of type Undefined is not
                            JSON serializable
    clock without 'format': same

Both keys are now set explicitly. Verified: removing either assignment
fails 4 of the new tests.

E741 on my own injection-test file: two `for i, l in enumerate(...)`
loops, which ruff rejects and would fail a lint-gated build. Renamed.
Ruff now clean on all three files this PR touches.

Not done: registering composer_bp. This PR's own description gates it --
"Not yet wired up ... tracking as a follow-up", with an unchecked box for
"Register composer_bp in app.py before merging or exposing this route" --
so it is a deliberate decision, not an oversight. Confirmed the blueprint
appears in no register_blueprint call outside this branch's tests, which
also means the code-injection fixed earlier in this PR was never
reachable in a deployed instance. Worth fixing before the route is
exposed; not worth exposing the route to satisfy a review comment.

Verified on the merged tree: 3850 passed, 1 failed, 60 skipped. The
failure is test_install_lowmem's tmpfs assumption, which is fixed in #492
and not yet on main. The static audit now passes 3/3 -- the twelve
classes it flagged before were defined on main all along and only looked
missing because this branch was behind.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01STMbQE4YctTacQXfbYqKuW

test/test_composer_code_injection.py

@@ -164,8 +164,34 @@ def test_the_generated_config_assignment_does_not_precede_super_init():
     """Guards the reasoning behind the reserved list, not just the list."""
     src = _generated(_with_key("brightness"))
     body = src.splitlines()
-    super_at = next(i for i, l in enumerate(body) if "super().__init__(" in l)
-    assign_at = next(i for i, l in enumerate(body) if "self.brightness = config.get(" in l)
+    super_at = next(i for i, line in enumerate(body) if "super().__init__(" in line)
+    assign_at = next(i for i, line in enumerate(body)
+                     if "self.brightness = config.get(" in line)
     assert assign_at > super_at, (
         "config vars are assigned before super().__init__(); the reserved-name "
         "list assumes they land after it")
+
+
+# --- optional keys ----------------------------------------------------------
+
+@pytest.mark.parametrize("el_type,missing", [
+    ("text", "text"), ("text", "text2"), ("clock", "format"),
+])
+def test_an_element_missing_an_optional_key_does_not_500(el_type, missing):
+    """`p` is a copy of the raw element, so an absent key stays absent.
+
+    The defaults were applied to locals only, so manager.py.j2 rendered
+    `{{ el.text | tojson }}` over a jinja2.Undefined and tojson raised
+    TypeError -- which no handler catches, making a missing key a 500 rather
+    than a validation error or a sensible default.
+    """
+    el = {"type": el_type, "id": "e1", "x": 0, "y": 0, "font": "press_start"}
+    src = _generated(_payload(elements=[el]))
+    ast.parse(src)          # must still be valid Python
+    assert "Undefined" not in src
+
+
+def test_a_clock_without_a_format_uses_the_documented_default():
+    el = {"type": "clock", "id": "c1", "x": 0, "y": 0, "font": "press_start"}
+    src = _generated(_payload(elements=[el]))
+    assert '"%H:%M"' in src, "the %H:%M default did not reach the generated source"