fix(core): font zip cache, monotonic timers, resolver back-off, and other core/common fixes (#654)

* fix(core): font zip cache, monotonic timers, resolver back-off, and other core/common fixes

- font_manager: a .zip font URL is served as its extracted font after a
  restart (the cached-file check returned the archive first); downloads
  use requests with a 30s timeout into a temp file + os.replace.
- api_helper / sync_manager: rate-limit and heartbeat/leader timeouts use
  time.monotonic(); last_request_time and the status file's ts stay
  wall-clock. set_on_new_cycle docstring no longer claims core uses it.
- logo_helper: the placeholder uses the same scaled box as a real logo.
- permission_utils: one _sudo_bash_candidates() helper (with the sudoers
  exact-argv rationale) shared by sudo_remove_directory, which now retries
  the next bash path on a sudo refusal, and install_requirements_file.
- dynamic_team_resolver: failed/empty fetch backs off 5 min; duplicate
  INFO log and contradictory docstring example fixed.
- element_style: scale default looked up through element aliases.
- background_data_service: cache-hit callback runs outside the lock.
- config_arrays: union-aware type check (["array","null"]); stale
  dotToNested() reference removed.
- auto_update_setup: non-dict auto_update reads as off; temp result file
  unlinked when the write fails.
- exceptions: constructors copy the caller's context dict.
- logging_config: StructuredFormatter json.dumps(default=str).
- error_aggregator: removed unused export_path/export_to_file/_auto_export.
- Docstrings: validate_file_upload max_size_mb, raise_on_errors.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(sync): retry the status-file rename like the other atomic writers

On Windows os.replace can fail with "Access is denied" while a scanner
briefly holds the target open; config_manager_atomic._replace already
retries that (and re-raises at once on other platforms). The sync status
writer called os.replace directly, which made
test_concurrent_writers_each_use_their_own_temp_file flaky on Windows.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

test/test_sync_manager.py

@@ -120,7 +120,7 @@ def raise_n_then_stop(mgr, exc, count):
     return _side_effect
 
 
-def fake_clock(monkeypatch, *, time_fn=None, sleep_fn=None):
+def fake_clock(monkeypatch, *, time_fn=None, sleep_fn=None, monotonic_fn=None):
     """Swap sync_manager's own `time` reference for a private stand-in.
 
     sync_manager.time IS the stdlib module, so patching attributes on it
@@ -129,9 +129,14 @@ def fake_clock(monkeypatch, *, time_fn=None, sleep_fn=None):
     hard-to-trace source of cross-test flakiness. Rebinding the module's
     reference keeps the patch scoped to the code under test. Anything not
     overridden falls through to the real functions.
+
+    ``time_fn`` drives both clocks unless ``monotonic_fn`` is given: the
+    timers read time.monotonic(), and a test that only needs "a frozen
+    clock" shouldn't care which one.
     """
     monkeypatch.setattr(sync_manager, "time", SimpleNamespace(
         time=time_fn or time.time,
+        monotonic=monotonic_fn or time_fn or time.monotonic,
         sleep=sleep_fn or time.sleep,
     ))
 
@@ -310,6 +315,34 @@ class TestWatchdogs:
         assert mgr._leader_state is LeaderState.CONNECTED
         assert mgr._peer_ip == "10.0.0.1"
 
+    def test_wall_clock_jump_does_not_time_out_the_peer(self, monkeypatch):
+        # A Pi has no RTC: NTP can step the wall clock by hours after the
+        # peer connected. Only elapsed (monotonic) time counts toward the
+        # heartbeat timeout.
+        mgr = make_manager(role=SyncRole.LEADER)
+        mgr._leader_state = LeaderState.CONNECTED
+        mgr._peer_ip = "10.0.0.1"
+        mgr._last_heartbeat_time = 100.0
+        fake_clock(monkeypatch,
+                   time_fn=lambda: 100.0 + 3600,
+                   monotonic_fn=lambda: 101.0,
+                   sleep_fn=lambda _: setattr(mgr, "_running", False))
+        mgr._running = True
+        mgr._leader_watchdog()
+        assert mgr._leader_state is LeaderState.CONNECTED
+
+    def test_wall_clock_jump_does_not_drop_the_leader(self, monkeypatch):
+        mgr = make_manager(role=SyncRole.FOLLOWER)
+        mgr._follower_state = FollowerState.FOLLOWER
+        mgr._last_leader_frame_time = 100.0
+        fake_clock(monkeypatch,
+                   time_fn=lambda: 100.0 + 3600,
+                   monotonic_fn=lambda: 101.0,
+                   sleep_fn=lambda _: setattr(mgr, "_running", False))
+        mgr._running = True
+        mgr._follower_watchdog()
+        assert mgr._follower_state is FollowerState.FOLLOWER
+
     def test_leader_watchdog_ignores_disconnected_state(self, monkeypatch):
         mgr = make_manager(role=SyncRole.LEADER)
         mgr._leader_state = LeaderState.INCOMPATIBLE
@@ -496,7 +529,8 @@ class TestFollowerRecvLoop:
         mgr = make_manager(role=SyncRole.FOLLOWER)
         sleeps = MagicMock()
         with patch.object(sync_manager, "time",
-                          SimpleNamespace(time=time.time, sleep=sleeps)):
+                          SimpleNamespace(time=time.time, monotonic=time.monotonic,
+                                          sleep=sleeps)):
             self._drive(mgr, b"12345")
         assert mgr.get_latest_frame() is None
         sleeps.assert_not_called()
@@ -507,7 +541,8 @@ class TestFollowerRecvLoop:
             mgr = make_manager(role=SyncRole.FOLLOWER)
             sleeps = MagicMock()
             with patch.object(sync_manager, "time",
-                              SimpleNamespace(time=time.time, sleep=sleeps)):
+                              SimpleNamespace(time=time.time, monotonic=time.monotonic,
+                                              sleep=sleeps)):
                 self._drive(mgr, json.dumps(payload).encode())
             assert mgr.get_latest_scroll_x() is None
             sleeps.assert_not_called()