refactor: comprehensive code quality, security, and release readiness improvements

Security: tighten CORS defaults, add webhook rate limiting, fix XSS in
automations, guard WebSocket JSON.parse, validate ADB address input,
seal debug exception leak, URL-encode WS tokens, CSS.escape in selectors.

Code quality: add Pydantic models for brightness/power endpoints, fix
thread safety and name uniqueness in DeviceStore, immutable update
pattern, split 6 oversized files into 16 focused modules, enable
TypeScript strictNullChecks (741→102 errors), type state variables,
add dom-utils helper, migrate 3 modules from inline onclick to event
delegation, ProcessorDependencies dataclass.

Performance: async store saves, health endpoint log level, command
palette debounce, optimized entity-events comparison, fix service
worker precache list.

Testing: expand from 45 to 293 passing tests — add store tests (141),
route tests (25), core logic tests (42), E2E flow tests (33), organize
into tests/api/, tests/storage/, tests/core/, tests/e2e/.

DevOps: CI test pipeline, pre-commit config, Dockerfile multi-stage
build with non-root user and health check, docker-compose improvements,
version bump to 0.2.0.

Docs: rewrite CLAUDE.md (202→56 lines), server/CLAUDE.md (212→76),
create contexts/server-operations.md, fix .js→.ts references, fix env
var prefix in README, rewrite INSTALLATION.md, add CONTRIBUTING.md and
.env.example.

server/docker-compose.yml

@@ -1,41 +1,54 @@
-version: '3.8'
-
 services:
   wled-controller:
     build:
       context: .
       dockerfile: Dockerfile
+    image: ledgrab:latest
     container_name: wled-screen-controller
     restart: unless-stopped
 
     ports:
-      - "8080:8080"
+      - "${WLED_PORT:-8080}:8080"
 
     volumes:
-      # Persist device data
+      # Persist device data and configuration across restarts
       - ./data:/app/data
-      # Persist logs
       - ./logs:/app/logs
-      # Mount configuration (optional override)
-      - ./config:/app/config
-      # Required for screen capture on Linux
+      # Mount configuration for easy editing without rebuild
+      - ./config:/app/config:ro
+      # Required for screen capture on Linux (X11)
       - /tmp/.X11-unix:/tmp/.X11-unix:ro
 
     environment:
-      # Server configuration
+      ## Server
+      # Bind address and port (usually no need to change)
       - WLED_SERVER__HOST=0.0.0.0
       - WLED_SERVER__PORT=8080
       - WLED_SERVER__LOG_LEVEL=INFO
+      # CORS origins — add your LAN IP for remote access, e.g.:
+      #   WLED_SERVER__CORS_ORIGINS=["http://localhost:8080","http://192.168.1.100:8080"]
 
-      # Display for X11 (Linux only)
+      ## Auth
+      # Override the default API key (STRONGLY recommended for production):
+      #   WLED_AUTH__API_KEYS__main=your-secure-key-here
+      # Generate a key: openssl rand -hex 32
+
+      ## Display (Linux X11 only)
       - DISPLAY=${DISPLAY:-:0}
 
-      # Processing defaults
-      - WLED_PROCESSING__DEFAULT_FPS=30
-      - WLED_PROCESSING__BORDER_WIDTH=10
+      ## Processing defaults
+      #- WLED_PROCESSING__DEFAULT_FPS=30
+      #- WLED_PROCESSING__BORDER_WIDTH=10
 
-    # Use host network for screen capture access
-    # network_mode: host  # Uncomment for Linux screen capture
+      ## MQTT (optional — for Home Assistant auto-discovery)
+      #- WLED_MQTT__ENABLED=true
+      #- WLED_MQTT__BROKER_HOST=192.168.1.2
+      #- WLED_MQTT__BROKER_PORT=1883
+      #- WLED_MQTT__USERNAME=
+      #- WLED_MQTT__PASSWORD=
+
+    # Uncomment for Linux screen capture (requires host network for X11 access)
+    # network_mode: host
 
     networks:
       - wled-network