refactor: comprehensive code quality, security, and release readiness improvements

Security: tighten CORS defaults, add webhook rate limiting, fix XSS in
automations, guard WebSocket JSON.parse, validate ADB address input,
seal debug exception leak, URL-encode WS tokens, CSS.escape in selectors.

Code quality: add Pydantic models for brightness/power endpoints, fix
thread safety and name uniqueness in DeviceStore, immutable update
pattern, split 6 oversized files into 16 focused modules, enable
TypeScript strictNullChecks (741→102 errors), type state variables,
add dom-utils helper, migrate 3 modules from inline onclick to event
delegation, ProcessorDependencies dataclass.

Performance: async store saves, health endpoint log level, command
palette debounce, optimized entity-events comparison, fix service
worker precache list.

Testing: expand from 45 to 293 passing tests — add store tests (141),
route tests (25), core logic tests (42), E2E flow tests (33), organize
into tests/api/, tests/storage/, tests/core/, tests/e2e/.

DevOps: CI test pipeline, pre-commit config, Dockerfile multi-stage
build with non-root user and health check, docker-compose improvements,
version bump to 0.2.0.

Docs: rewrite CLAUDE.md (202→56 lines), server/CLAUDE.md (212→76),
create contexts/server-operations.md, fix .js→.ts references, fix env
var prefix in README, rewrite INSTALLATION.md, add CONTRIBUTING.md and
.env.example.

server/src/wled_controller/static/js/features/targets.ts

@@ -115,9 +115,9 @@ document.addEventListener('languageChanged', () => {
 
 // --- FPS sparkline history and chart instances for target cards ---
 const _TARGET_MAX_FPS_SAMPLES = 30;
-const _targetFpsHistory = {};        // fps_actual (rolling avg)
-const _targetFpsCurrentHistory = {}; // fps_current (sends/sec)
-const _targetFpsCharts = {};
+const _targetFpsHistory: Record<string, number[]> = {};        // fps_actual (rolling avg)
+const _targetFpsCurrentHistory: Record<string, number[]> = {}; // fps_current (sends/sec)
+const _targetFpsCharts: Record<string, any> = {};
 
 function _pushTargetFps(targetId: any, actual: any, current: any) {
     if (!_targetFpsHistory[targetId]) _targetFpsHistory[targetId] = [];
@@ -154,7 +154,7 @@ function _updateTargetFpsChart(targetId: any, fpsTarget: any) {
 }
 
 // --- Editor state ---
-let _editorCssSources = [];   // populated when editor opens
+let _editorCssSources: any[] = [];   // populated when editor opens
 let _targetTagsInput: TagInput | null = null;
 
 class TargetEditorModal extends Modal {
@@ -343,12 +343,12 @@ function _ensureProtocolIconSelect() {
     _protocolIconSelect = new IconSelect({ target: sel as HTMLSelectElement, items, columns: 2 });
 }
 
-export async function showTargetEditor(targetId = null, cloneData = null) {
+export async function showTargetEditor(targetId: string | null = null, cloneData: any = null) {
     try {
         // Load devices, CSS sources, and value sources for dropdowns
         const [devices, cssSources] = await Promise.all([
-            devicesCache.fetch().catch(() => []),
-            colorStripSourcesCache.fetch().catch(() => []),
+            devicesCache.fetch().catch((): any[] => []),
+            colorStripSourcesCache.fetch().catch((): any[] => []),
             valueSourcesCache.fetch(),
         ]);
 
@@ -368,7 +368,7 @@ export async function showTargetEditor(targetId = null, cloneData = null) {
             deviceSelect.appendChild(opt);
         });
 
-        let _editorTags = [];
+        let _editorTags: string[] = [];
         if (targetId) {
             // Editing existing target
             const resp = await fetch(`${API_BASE}/output-targets/${targetId}`, { headers: getHeaders() });
@@ -598,14 +598,14 @@ export async function loadTargetsTab() {
     try {
         // Fetch all entities via DataCache
         const [devices, targets, cssArr, patternTemplates, psArr, valueSrcArr, asSrcArr] = await Promise.all([
-            devicesCache.fetch().catch(() => []),
-            outputTargetsCache.fetch().catch(() => []),
-            colorStripSourcesCache.fetch().catch(() => []),
-            patternTemplatesCache.fetch().catch(() => []),
-            streamsCache.fetch().catch(() => []),
-            valueSourcesCache.fetch().catch(() => []),
-            audioSourcesCache.fetch().catch(() => []),
-            syncClocksCache.fetch().catch(() => []),
+            devicesCache.fetch().catch((): any[] => []),
+            outputTargetsCache.fetch().catch((): any[] => []),
+            colorStripSourcesCache.fetch().catch((): any[] => []),
+            patternTemplatesCache.fetch().catch((): any[] => []),
+            streamsCache.fetch().catch((): any[] => []),
+            valueSourcesCache.fetch().catch((): any[] => []),
+            audioSourcesCache.fetch().catch((): any[] => []),
+            syncClocksCache.fetch().catch((): any[] => []),
         ]);
 
         const colorStripSourceMap = {};
@@ -698,7 +698,7 @@ export async function loadTargetsTab() {
         const patternItems = csPatternTemplates.applySortOrder(patternTemplates.map(pt => ({ key: pt.id, html: createPatternTemplateCard(pt) })));
 
         // Track which target cards were replaced/added (need chart re-init)
-        let changedTargetIds = null;
+        let changedTargetIds: Set<string> | null = null;
 
         if (csDevices.isMounted()) {
             // ── Incremental update: reconcile cards in-place ──
@@ -760,13 +760,13 @@ export async function loadTargetsTab() {
             if ((device.capabilities || []).includes('brightness_control')) {
                 if (device.id in _deviceBrightnessCache) {
                     const bri = _deviceBrightnessCache[device.id];
-                    const slider = document.querySelector(`[data-device-brightness="${device.id}"]`) as HTMLInputElement | null;
+                    const slider = document.querySelector(`[data-device-brightness="${CSS.escape(device.id)}"]`) as HTMLInputElement | null;
                     if (slider) {
                         slider.value = String(bri);
                         slider.title = Math.round(bri / 255 * 100) + '%';
                         slider.disabled = false;
                     }
-                    const wrap = document.querySelector(`[data-brightness-wrap="${device.id}"]`);
+                    const wrap = document.querySelector(`[data-brightness-wrap="${CSS.escape(device.id)}"]`);
                     if (wrap) wrap.classList.remove('brightness-loading');
                 } else {
                     fetchDeviceBrightness(device.id);
@@ -780,7 +780,7 @@ export async function loadTargetsTab() {
 
         // Patch "Last seen" labels in-place (avoids full card re-render on relative time changes)
         for (const device of devicesWithState) {
-            const el = container.querySelector(`[data-last-seen="${device.id}"]`) as HTMLElement | null;
+            const el = container.querySelector(`[data-last-seen="${CSS.escape(device.id)}"]`) as HTMLElement | null;
             if (el) {
                 const ts = device.state?.device_last_checked;
                 const label = ts ? formatRelativeTime(ts) : null;
@@ -918,7 +918,7 @@ function _buildLedTimingHTML(state: any) {
 function _patchTargetMetrics(target: any) {
     const container = document.getElementById('targets-panel-content');
     if (!container) return;
-    const card = container.querySelector(`[data-target-id="${target.id}"]`);
+    const card = container.querySelector(`[data-target-id="${CSS.escape(target.id)}"]`);
     if (!card) return;
     const state = target.state || {};
     const metrics = target.metrics || {};
@@ -1141,7 +1141,7 @@ export async function stopAllKCTargets() {
 async function _stopAllByType(targetType: any) {
     try {
         const [allTargets, statesResp] = await Promise.all([
-            outputTargetsCache.fetch().catch(() => []),
+            outputTargetsCache.fetch().catch((): any[] => []),
             fetchWithAuth('/output-targets/batch/states'),
         ]);
         const statesData = statesResp.ok ? await statesResp.json() : { states: {} };
@@ -1339,7 +1339,7 @@ function _renderLedStrip(canvas: any, rgbBytes: any) {
     canvas.width = ledCount;
     canvas.height = 1;
 
-    const ctx = canvas.getContext('2d');
+    const ctx = canvas.getContext('2d')!;
     const imageData = ctx.createImageData(ledCount, 1);
     const data = imageData.data;
 
@@ -1447,7 +1447,7 @@ function connectLedPreviewWS(targetId: any) {
 }
 
 function _setPreviewButtonState(targetId: any, active: boolean) {
-    const btn = document.querySelector(`[data-led-preview-btn="${targetId}"]`);
+    const btn = document.querySelector(`[data-led-preview-btn="${CSS.escape(targetId)}"]`);
     if (btn) {
         btn.classList.toggle('btn-warning', active);
         btn.classList.toggle('btn-secondary', !active);