Merge origin/main (#592, #593, #594) into the September 16 core audit fixes

config.py conflict: #594 discovers plugins before /config/main matches plugin
keys; this branch routes those sections through the /plugins/config
preparation (F13). Kept both.

#594's secret-separation test posts a plugin section to /config/main, which
this branch now validates through api_v3.schema_manager; the test gets a real
SchemaManager over its temporary plugins directory instead of the helper's
mock. It still fails if the discovery call is reverted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

systemd/ledmatrix-web.service

@@ -25,9 +25,13 @@ RestartSec=10
 StandardOutput=syslog
 StandardError=syslog
 SyslogIdentifier=ledmatrix-web
-# Automatically create and manage cache directory
-CacheDirectory=ledmatrix
-CacheDirectoryMode=0775
+# No CacheDirectory=. /var/cache/ledmatrix is shared with ledmatrix.service,
+# which runs as root, and the installers set it up as root:ledmatrix 2775 so
+# both services can read what the other writes. CacheDirectory= makes systemd
+# re-own that directory and everything in it to this unit's User= and that
+# user's primary group whenever the owner differs -- which, for a directory
+# root created, is on the first start. That erased the shared group, and from
+# then on the web interface could not read a single file the display wrote.
 
 [Install]
 WantedBy=multi-user.target