feat: asset-based image/video sources, notification sounds, UI improvements

- Replace URL-based image_source/url fields with image_asset_id/video_asset_id
  on StaticImagePictureSource and VideoCaptureSource (clean break, no migration)
- Resolve asset IDs to file paths at runtime via AssetStore.get_file_path()
- Add EntitySelect asset pickers for image/video in stream editor modal
- Add notification sound configuration (global sound + per-app overrides)
- Unify per-app color and sound overrides into single "Per-App Overrides" section
- Persist notification history between server restarts
- Add asset management system (upload, edit, delete, soft-delete)
- Replace emoji buttons with SVG icons throughout UI
- Various backend improvements: SQLite stores, auth, backup, MQTT, webhooks

contexts/frontend.md

@@ -175,7 +175,7 @@ When adding **new tabs, sections, or major UI elements**, update the correspondi
 
 When you need a new icon:
 1. Find the Lucide icon at https://lucide.dev
-2. Copy the inner SVG elements (paths, circles, rects) into `icon-paths.js` as a new export
+2. Copy the inner SVG elements (paths, circles, rects) into `icon-paths.ts` as a new export
 3. Add a corresponding `ICON_*` constant in `icons.ts` using `_svg(P.myIcon)`
 4. Import and use the constant in your feature module
 
@@ -213,7 +213,19 @@ Static HTML using `data-i18n` attributes is handled automatically by the i18n sy
 - `fetchWithAuth('/devices/dev_123', { method: 'DELETE' })` → `DELETE /api/v1/devices/dev_123`
 - Passing `/api/v1/gradients` results in **double prefix**: `/api/v1/api/v1/gradients` (404)
 
-For raw `fetch()` without auth (rare), use the full path manually.
+**NEVER use raw `fetch()` or `new Audio(url)` / `new Image()` for authenticated endpoints.** These bypass the auth token and will fail with 401. Always use `fetchWithAuth()` and convert to blob URLs when needed (e.g. for `<audio>`, `<img>`, or download links):
+
+```typescript
+// WRONG: no auth header — 401
+const audio = new Audio(`${API_BASE}/assets/${id}/file`);
+
+// CORRECT: fetch with auth, then create blob URL
+const res = await fetchWithAuth(`/assets/${id}/file`);
+const blob = await res.blob();
+const audio = new Audio(URL.createObjectURL(blob));
+```
+
+The only exception is raw `fetch()` for multipart uploads where you must set `Content-Type` to let the browser handle the boundary — but still use `getHeaders()` for the auth token.
 
 ## Bundling & Development Workflow
 
@@ -266,11 +278,11 @@ See [`contexts/chrome-tools.md`](chrome-tools.md) for Chrome MCP tool usage, bro
 
 ### Uptime / duration values
 
-Use `formatUptime(seconds)` from `core/ui.js`. Outputs `{s}s`, `{m}m {s}s`, or `{h}h {m}m` via i18n keys `time.seconds`, `time.minutes_seconds`, `time.hours_minutes`.
+Use `formatUptime(seconds)` from `core/ui.ts`. Outputs `{s}s`, `{m}m {s}s`, or `{h}h {m}m` via i18n keys `time.seconds`, `time.minutes_seconds`, `time.hours_minutes`.
 
 ### Large numbers
 
-Use `formatCompact(n)` from `core/ui.js`. Outputs `1.2K`, `3.5M` etc. Set `element.title` to the exact value for hover detail.
+Use `formatCompact(n)` from `core/ui.ts`. Outputs `1.2K`, `3.5M` etc. Set `element.title` to the exact value for hover detail.
 
 ### Preventing layout shift