refactor: comprehensive code quality, security, and release readiness improvements

Security: tighten CORS defaults, add webhook rate limiting, fix XSS in
automations, guard WebSocket JSON.parse, validate ADB address input,
seal debug exception leak, URL-encode WS tokens, CSS.escape in selectors.

Code quality: add Pydantic models for brightness/power endpoints, fix
thread safety and name uniqueness in DeviceStore, immutable update
pattern, split 6 oversized files into 16 focused modules, enable
TypeScript strictNullChecks (741→102 errors), type state variables,
add dom-utils helper, migrate 3 modules from inline onclick to event
delegation, ProcessorDependencies dataclass.

Performance: async store saves, health endpoint log level, command
palette debounce, optimized entity-events comparison, fix service
worker precache list.

Testing: expand from 45 to 293 passing tests — add store tests (141),
route tests (25), core logic tests (42), E2E flow tests (33), organize
into tests/api/, tests/storage/, tests/core/, tests/e2e/.

DevOps: CI test pipeline, pre-commit config, Dockerfile multi-stage
build with non-root user and health check, docker-compose improvements,
version bump to 0.2.0.

Docs: rewrite CLAUDE.md (202→56 lines), server/CLAUDE.md (212→76),
create contexts/server-operations.md, fix .js→.ts references, fix env
var prefix in README, rewrite INSTALLATION.md, add CONTRIBUTING.md and
.env.example.

server/src/wled_controller/static/js/features/automations.ts

@@ -18,7 +18,7 @@ import { IconSelect } from '../core/icon-select.ts';
 import { EntitySelect } from '../core/entity-palette.ts';
 import { attachProcessPicker } from '../core/process-picker.ts';
 import { TreeNav } from '../core/tree-nav.ts';
-import { csScenes, createSceneCard } from './scene-presets.ts';
+import { csScenes, createSceneCard, initScenePresetDelegation } from './scene-presets.ts';
 import type { Automation } from '../types.ts';
 
 let _automationTagsInput: any = null;
@@ -158,7 +158,7 @@ export async function loadAutomations() {
     } catch (error: any) {
         if (error.isAuth) return;
         console.error('Failed to load automations:', error);
-        container.innerHTML = `<p class="error-message">${error.message}</p>`;
+        container.innerHTML = `<p class="error-message">${escapeHtml(error.message)}</p>`;
     } finally {
         set_automationsLoading(false);
         setTabRefreshing('automations-content', false);
@@ -194,6 +194,9 @@ function renderAutomations(automations: any, sceneMap: any) {
         container.innerHTML = panels;
         CardSection.bindAll([csAutomations, csScenes]);
 
+        // Event delegation for scene preset card actions
+        initScenePresetDelegation(container);
+
         _automationsTree.setExtraHtml(`<button class="tutorial-trigger-btn" onclick="startAutomationsTutorial()" data-i18n-title="tour.restart" title="${t('tour.restart')}">${ICON_HELP}</button>`);
         _automationsTree.update(treeItems, activeTab);
         _automationsTree.observeSections('automations-content', {