Add a Django test harness and initial REST API tests - #388

Adds 113 tests (210 total) covering the rest of the web app:

- test_pages: every full page and htmx partial renders, including on a
  fresh install, and the temperature-sensor pickers route to the
  configured source
- test_settings: settings form (secret handling, trailing slashes,
  defaults), weather & time, theme, the first-run wizard, the settings REST
  endpoints and web.settings_helper
- test_panels: accept/deny/delete/unblock, the per-panel settings form and
  the legacy api/ panel endpoints
- test_relay_groups: form views, htmx endpoints and the REST listing
- test_files: firmware/LittleFS/TFT upload, checksum and download,
  including which TFT each panel type gets and a contract test for the
  exclusive Range end the panel firmware depends on
- test_misc: messages, HA/OpenHAB entity lookups, hostname lookup and
  read-only listings

New known issues are pinned with @expectedfailure as before.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…itive

banned_setting_keys lists secrets in upper case ("HOME_ASSISTANT_TOKEN"),
but settings are stored in lower case ("home_assistant_token") and the
comparison was case-sensitive, so /rest/mqttmanager/settings returned the
MQTT password and Home Assistant/OpenHAB tokens it was meant to withhold.

Nothing in the repo calls this endpoint (MQTTManager reads settings from
the database directly), so refusing these keys breaks no caller.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

These views changed config MQTTManager reads from the database but never
called send_mqttmanager_reload_command(), so panels kept the old config
until something else triggered a reload:

- DELETE /rest/scenes/<id>
- PUT /rest/entities_pages/<id> (page resize)
- htmx/nspanels/<id>/delete
- htmx relay group save and delete

Co-Authored-By: Claude Opus 5.5 <[email protected]>

- POST /rest/rooms now creates the room's entities and scenes pages, as
  save_new_room does, instead of leaving them to the next restart. The
  per-room part of create_entity_pages_for_all_rooms() is split out as
  create_entity_pages_for_room() so both paths share it.
- The name must be 1-30 characters (Room.friendly_name's max_length,
  which SQLite does not enforce).
- DELETE /rest/rooms/<id> moves the room's panels to another room, as
  delete_room does, and tells MQTTManager to reload. Creating a room now
  reloads too.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Each entry was saved as it was read, so an unknown id part-way through
the list returned an error but left the entries before it already moved,
a half-applied layout. Run the updates in one transaction so a failed
request changes nothing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The /rest/entities/* endpoints stored room_view_position and
entities_page_id as given, so the UI (or any other caller) could:

- put two entities in the same slot;
- put one in a slot past the end of its page, where the panel never
  shows it;
- put an entity on another room's page.

get_placement_error() checks all three and the endpoints return 400
with a message. Only a new or changed placement is checked, so an
entity already saved in a bad slot can still be edited in place.

PUT /rest/rooms/<id>/entities/order now also rejects slots past the end
of a page. It does not check for occupied slots, because a swap moves
two entities through each other's slot in one request.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The entity endpoints stored controller and scene_type as given. MQTTManager
logs an error for an entity whose controller its class does not handle
and skips a scene with an unknown scene_type, so these saved fine but
never worked on a panel. Now rejected with 400:

- a controller the entity type does not support (e.g. an OpenHAB button);
- an unknown scene_type;
- a Home Assistant or OpenHAB scene with an empty backend_name, which
  could never be activated.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…rink

- Creating a page (room or global) with any other size is rejected with
  400; the panel GUI only has those three layouts.
- PUT /rest/entities_pages/<id> checks the new size the same way, and
  refuses to shrink a page while an entity or scene sits in a slot past
  the new end. Those entities stayed attached to the page but were never
  shown on the panel. The UI already only offers 4/8/12.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The method check in entities_thermostats() and entities_scenes() was
commented out, so a GET, POST or DELETE was handled as a save. Restore
it, and answer unsupported methods on all five /rest/entities/* save
endpoints with 405 rather than 403.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

- GET /rest/settings returned 500 until the Home Assistant token, the
  OpenHAB token and the MQTT password had all been saved at least once,
  because it del'd each key without checking it existed (e.g. OpenHAB
  never configured). Missing secrets now report *_set: false.
- GET /rest/scenes?scene_id=N checked for a light_id parameter, then
  filtered on scene_id, so the filter was ignored and every scene came
  back.
- The checksum_firmware, checksum_data_file and checksum_tft_file
  endpoints returned 200 with the body "None" when no image had been
  uploaded. They now return 404 with an empty body. The panel firmware
  does not check the status code, so for a panel this only changes the
  string it compares against its stored checksum.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

- api/get_nspanel_config always returned 500: it read
  button1/2_detached_mode_light, which were renamed to
  button1/2_detached_mode_entity. Use the new names, and fix the else
  branch writing -1 to "button1_detached_mode_light" instead of the
  "button1_detached_light" key the other branch sets. Kept rather than
  removed because panels on older firmware may still call it.
- Remove htmx/partial/nspanel_index_view/<id>, which always raised
  ImproperlyConfigured (nspanel_status_header has no template for that
  URL name), and htmx/partial/edit_entities_page/<id>, whose template was
  removed in the move to React, along with its save/<page_type> route and
  the edit button in the old htmx entities-page component that linked to
  it. Nothing in the current UI reaches any of them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

- The htmx first-run wizard and the index panels partial are gone; the
  React InitialSetup now saves everything with one POST /rest/settings.
  Test that endpoint (saves, only touches submitted keys, rejects bad
  payloads, reloads once) and that the index shows InitialSetup until a
  manager address is configured.
- /rest/mqttmanager/settings (POST) was removed; keep the banned-key
  tests for the per-key GET endpoint.
- GET /rest/rooms now returns friendly_name, display_order and the
  temperature sensor fields; PUT /rest/rooms updates a room. Pin the
  display_order/displayOrder mismatch in room_put as a known bug.
- Thermostats now require use_current_temperature.

Co-Authored-By: Claude Opus 5.5 <[email protected]>