refactor: comprehensive code quality, security, and release readiness improvements

Security: tighten CORS defaults, add webhook rate limiting, fix XSS in
automations, guard WebSocket JSON.parse, validate ADB address input,
seal debug exception leak, URL-encode WS tokens, CSS.escape in selectors.

Code quality: add Pydantic models for brightness/power endpoints, fix
thread safety and name uniqueness in DeviceStore, immutable update
pattern, split 6 oversized files into 16 focused modules, enable
TypeScript strictNullChecks (741→102 errors), type state variables,
add dom-utils helper, migrate 3 modules from inline onclick to event
delegation, ProcessorDependencies dataclass.

Performance: async store saves, health endpoint log level, command
palette debounce, optimized entity-events comparison, fix service
worker precache list.

Testing: expand from 45 to 293 passing tests — add store tests (141),
route tests (25), core logic tests (42), E2E flow tests (33), organize
into tests/api/, tests/storage/, tests/core/, tests/e2e/.

DevOps: CI test pipeline, pre-commit config, Dockerfile multi-stage
build with non-root user and health check, docker-compose improvements,
version bump to 0.2.0.

Docs: rewrite CLAUDE.md (202→56 lines), server/CLAUDE.md (212→76),
create contexts/server-operations.md, fix .js→.ts references, fix env
var prefix in README, rewrite INSTALLATION.md, add CONTRIBUTING.md and
.env.example.

server/src/wled_controller/static/js/app.ts

@@ -5,6 +5,7 @@
 // Layer 0: state
 import { apiKey, setApiKey, refreshInterval } from './core/state.ts';
 import { Modal } from './core/modal.ts';
+import { queryEl } from './core/dom-utils.ts';
 
 // Layer 1: api, i18n
 import { loadServerInfo, loadDisplays, configureApiKey, startConnectionMonitor, stopConnectionMonitor } from './core/api.ts';
@@ -93,8 +94,8 @@ import {
 } from './features/automations.ts';
 import {
     openScenePresetCapture, editScenePreset, saveScenePreset, closeScenePresetEditor,
-    activateScenePreset, recaptureScenePreset, cloneScenePreset, deleteScenePreset,
-    addSceneTarget, removeSceneTarget,
+    activateScenePreset, cloneScenePreset, deleteScenePreset,
+    addSceneTarget,
 } from './features/scene-presets.ts';
 
 // Layer 5: device-discovery, targets
@@ -380,17 +381,15 @@ Object.assign(window, {
     deleteAutomation,
     copyWebhookUrl,
 
-    // scene presets
+    // scene presets (modal buttons stay on window; card actions migrated to event delegation)
     openScenePresetCapture,
     editScenePreset,
     saveScenePreset,
     closeScenePresetEditor,
     activateScenePreset,
-    recaptureScenePreset,
     cloneScenePreset,
     deleteScenePreset,
     addSceneTarget,
-    removeSceneTarget,
 
     // device-discovery
     onDeviceTypeChanged,
@@ -577,13 +576,13 @@ document.addEventListener('keydown', (e) => {
 
     if (e.key === 'Escape') {
         // Close in order: log overlay > overlay lightboxes > modals via stack
-        const logOverlay = document.getElementById('log-overlay');
+        const logOverlay = queryEl('log-overlay');
         if (logOverlay && logOverlay.style.display !== 'none') {
             closeLogOverlay();
-        } else if (document.getElementById('display-picker-lightbox').classList.contains('active')) {
-            closeDisplayPicker(null as any);
-        } else if (document.getElementById('image-lightbox').classList.contains('active')) {
-            closeLightbox(null as any);
+        } else if (queryEl('display-picker-lightbox')?.classList.contains('active')) {
+            closeDisplayPicker();
+        } else if (queryEl('image-lightbox')?.classList.contains('active')) {
+            closeLightbox();
         } else {
             Modal.closeTopmost();
         }
@@ -656,7 +655,8 @@ document.addEventListener('DOMContentLoaded', async () => {
     initCommandPalette();
 
     // Setup form handler
-    document.getElementById('add-device-form').addEventListener('submit', handleAddDevice);
+    const addDeviceForm = queryEl('add-device-form');
+    if (addDeviceForm) addDeviceForm.addEventListener('submit', handleAddDevice);
 
     // Always monitor server connection (even before login)
     loadServerInfo();