refactor: comprehensive code quality, security, and release readiness improvements

Security: tighten CORS defaults, add webhook rate limiting, fix XSS in
automations, guard WebSocket JSON.parse, validate ADB address input,
seal debug exception leak, URL-encode WS tokens, CSS.escape in selectors.

Code quality: add Pydantic models for brightness/power endpoints, fix
thread safety and name uniqueness in DeviceStore, immutable update
pattern, split 6 oversized files into 16 focused modules, enable
TypeScript strictNullChecks (741→102 errors), type state variables,
add dom-utils helper, migrate 3 modules from inline onclick to event
delegation, ProcessorDependencies dataclass.

Performance: async store saves, health endpoint log level, command
palette debounce, optimized entity-events comparison, fix service
worker precache list.

Testing: expand from 45 to 293 passing tests — add store tests (141),
route tests (25), core logic tests (42), E2E flow tests (33), organize
into tests/api/, tests/storage/, tests/core/, tests/e2e/.

DevOps: CI test pipeline, pre-commit config, Dockerfile multi-stage
build with non-root user and health check, docker-compose improvements,
version bump to 0.2.0.

Docs: rewrite CLAUDE.md (202→56 lines), server/CLAUDE.md (212→76),
create contexts/server-operations.md, fix .js→.ts references, fix env
var prefix in README, rewrite INSTALLATION.md, add CONTRIBUTING.md and
.env.example.

server/src/wled_controller/static/js/features/kc-targets.ts

@@ -141,7 +141,7 @@ function _ensureBrightnessEntitySelect() {
 }
 
 export function patchKCTargetMetrics(target: any) {
-    const card = document.querySelector(`[data-kc-target-id="${target.id}"]`);
+    const card = document.querySelector(`[data-kc-target-id="${CSS.escape(target.id)}"]`);
     if (!card) return;
     const state = target.state || {};
     const metrics = target.metrics || {};
@@ -523,8 +523,8 @@ export async function showKCEditor(targetId: any = null, cloneData: any = null)
     try {
         // Load sources, pattern templates, and value sources in parallel
         const [sources, patTemplates, valueSources] = await Promise.all([
-            streamsCache.fetch().catch(() => []),
-            patternTemplatesCache.fetch().catch(() => []),
+            streamsCache.fetch().catch((): any[] => []),
+            patternTemplatesCache.fetch().catch((): any[] => []),
             valueSourcesCache.fetch(),
         ]);
 
@@ -751,7 +751,7 @@ export async function deleteKCTarget(targetId: any) {
 // ===== KC BRIGHTNESS =====
 
 export function updateKCBrightnessLabel(targetId: any, value: any) {
-    const slider = document.querySelector(`[data-kc-brightness="${targetId}"]`) as HTMLElement;
+    const slider = document.querySelector(`[data-kc-brightness="${CSS.escape(targetId)}"]`) as HTMLElement;
     if (slider) slider.title = Math.round(parseInt(value) / 255 * 100) + '%';
 }