Web UI: install/reconfigure addons, default-on install, visual redesign (v2.17.0)

Web UI now installs by default during first-time provisioning (fixed
port 8090, no prompt) instead of being opt-in, and can install/
reconfigure CUPS Printing, LMS Server, Squeezelite Player, and Asterisk
Intercom, and check for updates - the addons and Update action asked
for by name.

Privilege model: the web service itself still runs as $KIOSK_USER with
zero ambient sudo. A new narrow, allow-listed root helper
(menus/addon_webui.sh's webui_write_helper_script) is the only way it
ever gains privilege, reachable only via a single-path passwordless
sudo rule generated and validated with `visudo -c -f` before being
installed, and it re-checks its own fixed action allow-list before
dispatching anything. Each allow-listed action is the exact same
interactive action_* function the terminal menu already uses, driven
by piping the right answers on stdin - the same technique this
project's own bash tests already use, so no prompt/mutation refactor
of any addon file was needed. webui/lib/actions.js's stdin sequences
were cross-validated against the real bash functions (not just read),
which caught two real bugs (Squeezelite and Asterisk Intercom both
silently lost their "decline reconfigure" path).

Long-running installs stream live output via Server-Sent Events
(webui/lib/jobs.js), one action at a time.

Full visual redesign: a sidebar shell (Sites/Display/Lockout/Addons/
Update) replacing the single scrolling page, light+dark themes via
prefers-color-scheme, no external font/CDN dependency. Actually driving
the redesigned UI in a headless browser (not just reading the code)
caught a real bug: refreshing an addon's pill/button after a successful
install used to rebuild the whole card, racing (and usually losing to)
the success status/log that job had just written. Fixed to update
pill/buttons in place.

Uninstall-via-web is deliberately still not offered, for any addon.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VfsFSoRqfbRG7XAg5RoE7e

webui/test/fixtures/fake-helper-with-status.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# Variant of fake-helper.sh that also implements status_all with real,
+# minimally stateful JSON (tracked via marker files alongside itself),
+# for browser/manual smoke testing of the Addons page's pills/buttons
+# actually flipping after a real install - not just that a job reports
+# success. jobs.test.js intentionally uses the plainer fake-helper.sh
+# instead, to exercise the malformed-status-response error path.
+STATE_DIR="$(dirname "$0")/.fake-state"
+mkdir -p "$STATE_DIR"
+
+if [[ "$1" == "status_all" ]]; then
+    state() { [[ -f "$STATE_DIR/$1" ]] && echo true || echo false; }
+    echo "{\"cups\":$(state cups),\"lms\":$(state lms),\"squeezelite\":$(state squeezelite),\"asterisk_intercom\":$(state asterisk_intercom)}"
+    exit 0
+fi
+
+echo "fake-helper: action=$1"
+stdin_content=$(cat)
+echo "fake-helper: stdin-bytes=${#stdin_content}"
+sleep 0.3
+
+case "$1" in
+    action_install_cups | action_reconfigure_cups) touch "$STATE_DIR/cups" ;;
+    action_install_lms) touch "$STATE_DIR/lms" ;;
+    action_install_squeezelite) touch "$STATE_DIR/squeezelite" ;;
+    action_configure_asterisk_intercom) touch "$STATE_DIR/asterisk_intercom" ;;
+esac
+
+echo "fake-helper: done"
+exit "${FAKE_HELPER_EXIT_CODE:-0}"

webui/test/fixtures/fake-helper.sh

@@ -0,0 +1,13 @@
+#!/bin/bash
+# webui/test/fixtures/fake-helper.sh - stands in for the real, root-owned
+# kiosk-webui-helper (menus/addon_webui.sh) in webui/test/jobs.test.js,
+# so the job/SSE system can be tested without real root or a real addon
+# install. Echoes what it received, sleeps briefly (long enough for the
+# "another job is already running" test to reliably observe it), then
+# exits with a controllable code.
+echo "fake-helper: action=$1"
+stdin_content=$(cat)
+echo "fake-helper: stdin-bytes=${#stdin_content}"
+sleep 0.2
+echo "fake-helper: done"
+exit "${FAKE_HELPER_EXIT_CODE:-0}"