Add tags to all entity types with chip-based input and autocomplete

- Add `tags: List[str]` field to all 13 entity types (devices, output targets,
  CSS sources, picture sources, audio sources, value sources, sync clocks,
  automations, scene presets, capture/audio/PP/pattern templates)
- Update all stores, schemas, and route handlers for tag CRUD
- Add GET /api/v1/tags endpoint aggregating unique tags across all stores
- Create TagInput component with chip display, autocomplete dropdown,
  keyboard navigation, and API-backed suggestions
- Display tag chips on all entity cards (searchable via existing text filter)
- Add tag input to all 14 editor modals with dirty check support
- Add CSS styles and i18n keys (en/ru/zh) for tag UI
- Also includes code review fixes: thread safety, perf, store dedup

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/wled_controller/core/backup/auto_backup.py

@@ -201,20 +201,25 @@ class AutoBackupEngine:
             })
         return backups
 
-    def delete_backup(self, filename: str) -> None:
-        # Validate filename to prevent path traversal
-        if os.sep in filename or "/" in filename or ".." in filename:
+    def _safe_backup_path(self, filename: str) -> Path:
+        """Resolve a backup filename to an absolute path, guarding against path traversal."""
+        if not filename or os.sep in filename or "/" in filename or ".." in filename:
             raise ValueError("Invalid filename")
-        target = self._backup_dir / filename
+        target = (self._backup_dir / filename).resolve()
+        # Ensure resolved path is still inside the backup directory
+        if not target.is_relative_to(self._backup_dir.resolve()):
+            raise ValueError("Invalid filename")
+        return target
+
+    def delete_backup(self, filename: str) -> None:
+        target = self._safe_backup_path(filename)
         if not target.exists():
             raise FileNotFoundError(f"Backup not found: {filename}")
         target.unlink()
         logger.info(f"Deleted backup: {filename}")
 
     def get_backup_path(self, filename: str) -> Path:
-        if os.sep in filename or "/" in filename or ".." in filename:
-            raise ValueError("Invalid filename")
-        target = self._backup_dir / filename
+        target = self._safe_backup_path(filename)
         if not target.exists():
             raise FileNotFoundError(f"Backup not found: {filename}")
         return target