refactor: comprehensive code quality, security, and release readiness improvements

Security: tighten CORS defaults, add webhook rate limiting, fix XSS in
automations, guard WebSocket JSON.parse, validate ADB address input,
seal debug exception leak, URL-encode WS tokens, CSS.escape in selectors.

Code quality: add Pydantic models for brightness/power endpoints, fix
thread safety and name uniqueness in DeviceStore, immutable update
pattern, split 6 oversized files into 16 focused modules, enable
TypeScript strictNullChecks (741→102 errors), type state variables,
add dom-utils helper, migrate 3 modules from inline onclick to event
delegation, ProcessorDependencies dataclass.

Performance: async store saves, health endpoint log level, command
palette debounce, optimized entity-events comparison, fix service
worker precache list.

Testing: expand from 45 to 293 passing tests — add store tests (141),
route tests (25), core logic tests (42), E2E flow tests (33), organize
into tests/api/, tests/storage/, tests/core/, tests/e2e/.

DevOps: CI test pipeline, pre-commit config, Dockerfile multi-stage
build with non-root user and health check, docker-compose improvements,
version bump to 0.2.0.

Docs: rewrite CLAUDE.md (202→56 lines), server/CLAUDE.md (212→76),
create contexts/server-operations.md, fix .js→.ts references, fix env
var prefix in README, rewrite INSTALLATION.md, add CONTRIBUTING.md and
.env.example.

server/tests/test_config.py

@@ -9,112 +9,90 @@ import yaml
 from wled_controller.config import (
     Config,
     ServerConfig,
-    ProcessingConfig,
-    WLEDConfig,
+    StorageConfig,
+    AuthConfig,
+    MQTTConfig,
+    LoggingConfig,
     get_config,
     reload_config,
+    is_demo_mode,
 )
 
 
-def test_default_config():
-    """Test default configuration values."""
-    config = Config()
+class TestDefaultConfig:
+    def test_default_server_values(self):
+        config = Config()
+        assert config.server.host == "0.0.0.0"
+        assert config.server.port == 8080
+        assert config.server.log_level == "INFO"
 
-    assert config.server.host == "0.0.0.0"
-    assert config.server.port == 8080
-    assert config.processing.default_fps == 30
-    assert config.processing.max_fps == 60
-    assert config.wled.timeout == 5
+    def test_default_storage_paths(self):
+        config = Config()
+        assert config.storage.devices_file == "data/devices.json"
+        assert config.storage.sync_clocks_file == "data/sync_clocks.json"
+
+    def test_default_mqtt_disabled(self):
+        config = Config()
+        assert config.mqtt.enabled is False
+
+    def test_default_demo_off(self):
+        config = Config()
+        assert config.demo is False
 
 
-def test_load_from_yaml(tmp_path):
-    """Test loading configuration from YAML file."""
-    config_data = {
-        "server": {"host": "127.0.0.1", "port": 9000},
-        "processing": {"default_fps": 60, "border_width": 20},
-        "wled": {"timeout": 10},
-    }
+class TestFromYaml:
+    def test_load_from_yaml(self, tmp_path):
+        config_data = {
+            "server": {"host": "127.0.0.1", "port": 9000},
+            "auth": {"api_keys": {"dev": "secret"}},
+        }
+        config_path = tmp_path / "test_config.yaml"
+        with open(config_path, "w") as f:
+            yaml.dump(config_data, f)
 
-    config_path = tmp_path / "test_config.yaml"
-    with open(config_path, "w") as f:
-        yaml.dump(config_data, f)
+        config = Config.from_yaml(config_path)
+        assert config.server.host == "127.0.0.1"
+        assert config.server.port == 9000
+        assert config.auth.api_keys == {"dev": "secret"}
 
-    config = Config.from_yaml(config_path)
-
-    assert config.server.host == "127.0.0.1"
-    assert config.server.port == 9000
-    assert config.processing.default_fps == 60
-    assert config.processing.border_width == 20
-    assert config.wled.timeout == 10
+    def test_load_from_yaml_file_not_found(self):
+        with pytest.raises(FileNotFoundError):
+            Config.from_yaml("nonexistent.yaml")
 
 
-def test_load_from_yaml_file_not_found():
-    """Test loading from non-existent YAML file."""
-    with pytest.raises(FileNotFoundError):
-        Config.from_yaml("nonexistent.yaml")
+class TestEnvironmentVariables:
+    def test_env_overrides(self, monkeypatch):
+        monkeypatch.setenv("WLED_SERVER__HOST", "192.168.1.1")
+        monkeypatch.setenv("WLED_SERVER__PORT", "7000")
+        config = Config()
+        assert config.server.host == "192.168.1.1"
+        assert config.server.port == 7000
 
 
-def test_environment_variables(monkeypatch):
-    """Test configuration from environment variables."""
-    monkeypatch.setenv("WLED_SERVER__HOST", "192.168.1.1")
-    monkeypatch.setenv("WLED_SERVER__PORT", "7000")
-    monkeypatch.setenv("WLED_PROCESSING__DEFAULT_FPS", "45")
-
-    config = Config()
-
-    assert config.server.host == "192.168.1.1"
-    assert config.server.port == 7000
-    assert config.processing.default_fps == 45
+class TestServerConfig:
+    def test_creation(self):
+        sc = ServerConfig(host="localhost", port=8000)
+        assert sc.host == "localhost"
+        assert sc.port == 8000
+        assert sc.log_level == "INFO"
 
 
-def test_server_config():
-    """Test server configuration."""
-    server_config = ServerConfig(host="localhost", port=8000)
+class TestDemoMode:
+    def test_demo_rewrites_storage_paths(self):
+        config = Config(demo=True)
+        assert config.storage.devices_file.startswith("data/demo/")
+        assert config.storage.sync_clocks_file.startswith("data/demo/")
 
-    assert server_config.host == "localhost"
-    assert server_config.port == 8000
-    assert server_config.log_level == "INFO"
+    def test_non_demo_keeps_original_paths(self):
+        config = Config(demo=False)
+        assert config.storage.devices_file == "data/devices.json"
 
 
-def test_processing_config():
-    """Test processing configuration."""
-    proc_config = ProcessingConfig(default_fps=25, max_fps=50)
+class TestGlobalConfig:
+    def test_get_config_returns_config(self):
+        config = get_config()
+        assert isinstance(config, Config)
 
-    assert proc_config.default_fps == 25
-    assert proc_config.max_fps == 50
-    assert proc_config.interpolation_mode == "average"
-
-
-def test_wled_config():
-    """Test WLED configuration."""
-    wled_config = WLEDConfig(timeout=10, retry_attempts=5)
-
-    assert wled_config.timeout == 10
-    assert wled_config.retry_attempts == 5
-    assert wled_config.protocol == "http"
-
-
-def test_config_validation():
-    """Test configuration validation."""
-    # Test valid interpolation mode
-    config = Config(
-        processing=ProcessingConfig(interpolation_mode="median")
-    )
-    assert config.processing.interpolation_mode == "median"
-
-    # Test invalid interpolation mode
-    with pytest.raises(ValueError):
-        ProcessingConfig(interpolation_mode="invalid")
-
-
-def test_get_config():
-    """Test global config getter."""
-    config = get_config()
-    assert isinstance(config, Config)
-
-
-def test_reload_config():
-    """Test config reload."""
-    config1 = get_config()
-    config2 = reload_config()
-    assert isinstance(config2, Config)
+    def test_reload_config_returns_new_config(self):
+        config = reload_config()
+        assert isinstance(config, Config)