Initial commit: WLED Screen Controller with FastAPI server and Home Assistant integration

This is a complete WLED ambient lighting controller that captures screen border pixels
and sends them to WLED devices for immersive ambient lighting effects.

## Server Features:
- FastAPI-based REST API with 17+ endpoints
- Real-time screen capture with multi-monitor support
- Advanced LED calibration system with visual GUI
- API key authentication with labeled tokens
- Per-device brightness control (0-100%)
- Configurable FPS (1-60), border width, and color correction
- Persistent device storage (JSON-based)
- Comprehensive Web UI with dark/light themes
- Docker support with docker-compose
- Windows monitor name detection via WMI (shows "LG ULTRAWIDE" etc.)

## Web UI Features:
- Device management (add, configure, remove WLED devices)
- Real-time status monitoring with FPS metrics
- Settings modal for device configuration
- Visual calibration GUI with edge testing
- Brightness slider per device
- Display selection with friendly monitor names
- Token-based authentication with login/logout
- Responsive button layout

## Calibration System:
- Support for any LED strip layout (clockwise/counterclockwise)
- 4 starting position options (corners)
- Per-edge LED count configuration
- Visual preview with starting position indicator
- Test buttons to light up individual edges
- Smart LED ordering based on start position and direction

## Home Assistant Integration:
- Custom HACS integration
- Switch entities for processing control
- Sensor entities for status and FPS
- Select entities for display selection
- Config flow for easy setup
- Auto-discovery of devices from server

## Technical Stack:
- Python 3.11+
- FastAPI + uvicorn
- mss (screen capture)
- httpx (async WLED client)
- Pydantic (validation)
- WMI (Windows monitor detection)
- Structlog (logging)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

server/src/wled_controller/api/auth.py

@@ -0,0 +1,77 @@
+"""Authentication module for API key validation."""
+
+import secrets
+from typing import Annotated
+
+from fastapi import Depends, HTTPException, Security, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from wled_controller.config import get_config
+from wled_controller.utils import get_logger
+
+logger = get_logger(__name__)
+
+# Security scheme for Bearer token
+security = HTTPBearer(auto_error=False)
+
+
+def verify_api_key(
+    credentials: Annotated[HTTPAuthorizationCredentials | None, Security(security)]
+) -> str:
+    """Verify API key from Authorization header.
+
+    Args:
+        credentials: HTTP authorization credentials
+
+    Returns:
+        Label/identifier of the authenticated client
+
+    Raises:
+        HTTPException: If authentication is required but invalid
+    """
+    config = get_config()
+
+    # Check if credentials are provided
+    if not credentials:
+        logger.warning("Request missing Authorization header")
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Missing API key - authentication is required",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    # Extract token
+    token = credentials.credentials
+
+    # Verify against configured API keys
+    if not config.auth.api_keys:
+        logger.error("No API keys configured - server misconfiguration")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="Server authentication not configured properly",
+        )
+
+    # Find matching key and return its label using constant-time comparison
+    authenticated_as = None
+    for label, api_key in config.auth.api_keys.items():
+        if secrets.compare_digest(token, api_key):
+            authenticated_as = label
+            break
+
+    if not authenticated_as:
+        logger.warning(f"Invalid API key attempt: {token[:8]}...")
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid API key",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    # Log successful authentication
+    logger.debug(f"Authenticated as: {authenticated_as}")
+
+    return authenticated_as
+
+
+# Dependency for protected routes
+# Returns the label/identifier of the authenticated client
+AuthRequired = Annotated[str, Depends(verify_api_key)]