chore(backend): MQTT/WLED/devices/capture/utils + api routes hardening

Bundle the remaining backend touch-ups that the production review
landed individually as small surgical edits across many modules:
- MQTT runtime: fire-and-forget task tracking + drain resilience.
- mqtt_source + store + storage/color_strip_source: secret_box
  encryption for credentials with auto-migration of plaintext fields.
- devices/discovery_watcher: task tracking on watcher start/stop.
- devices/wled_client + wled_provider: URL scheme inference helper
  applied at the create/update boundary so bare hostnames stay valid.
- core/capture/screen_capture: hardened error paths.
- core/processing (mapped/processed/processor_manager/video/wled_target):
  smaller follow-throughs from the registry refactor that landed
  earlier on the branch.
- utils/safe_source + utils/file_ops + utils/__init__: shared URL +
  IP classification helpers + larger streaming upload size caps.
- api/auth: WebSocket Origin allow-list + /docs auth-gate.
- api/dependencies: register the new HTTP-endpoint store.
- api/routes (assets, backup, webhooks): streaming-upload caps +
  asyncio.gather return_exceptions on broadcast loops.
- tests/test_api + tests/e2e/test_backup_flow: cover the new caps and
  the Origin allow-list.

server/tests/e2e/test_backup_flow.py

@@ -12,22 +12,28 @@ class TestBackupRestoreFlow:
     """A user backs up their configuration and restores it."""
 
     def _create_device(self, client, name="Backup Device") -> str:
-        resp = client.post("/api/v1/devices", json={
-            "name": name,
-            "url": "mock://backup",
-            "device_type": "mock",
-            "led_count": 30,
-        })
+        resp = client.post(
+            "/api/v1/devices",
+            json={
+                "name": name,
+                "url": "mock://backup",
+                "device_type": "mock",
+                "led_count": 30,
+            },
+        )
         assert resp.status_code == 201
         return resp.json()["id"]
 
     def _create_css(self, client, name="Backup CSS") -> str:
-        resp = client.post("/api/v1/color-strip-sources", json={
-            "name": name,
-            "source_type": "static",
-            "color": [255, 0, 0],
-            "led_count": 30,
-        })
+        resp = client.post(
+            "/api/v1/color-strip-sources",
+            json={
+                "name": name,
+                "source_type": "single_color",
+                "color": [255, 0, 0],
+                "led_count": 30,
+            },
+        )
         assert resp.status_code == 201
         return resp.json()["id"]