Bump bunit from 1.32.7 to 2.7.2 - #6

bunit 2.x breaking changes per https://bunit.dev/docs/migrations/1to2.html:
  - TestContext renamed to BunitContext
  - RenderComponent<T>() unified into Render<T>()
  - IRenderedComponent<T> -> IRenderedComponent (not used here)
  - ComponentParameter / ComponentParameterFactory removed (not used here)

Applied across all 9 bunit-using test files:
  Components/Layout/SidebarFlyoutTests.cs
  Components/HomeSections/{HomeIntegrationTests,HomeModuleTilesTests,
    HomeScanBandTests,HomeDiscoveredCamerasTests,HomeDiscoveredAndroidTests}.cs
  Components/Shared/Settings/{SettingsSectionTests,SettingsGridTests,
    SettingsGridCellTests}.cs

Plus tests/ControlMenu.Tests/ControlMenu.Tests.csproj bunit ref bump.

Closes Dependabot PR #6 (closed manually in favor of this migration PR).

…ing + tag-signing) + scorecard PR trigger (#17)

Cross-repo Tier B security parity sweep. svgedit, OAO, ws-scrcpy-web all
landed equivalent ruleset tightening in parallel sessions today; this PR
brings CM to parity plus a CM-specific Scorecard-as-required-check extra.

Ruleset changes (API-only, already applied pre-PR via gh api PUT):
- Branch ruleset 16554261:
  - pull_request.allowed_merge_methods ["merge","squash","rebase"] -> ["squash","merge"]
  - required_status_checks: added Analyze (csharp), Analyze (javascript-typescript),
    Analyze (actions) (CodeQL App, integration_id 15368) + Scorecard analysis
- Tag ruleset 16554225: added required_signatures
- Repo-level: allow_rebase_merge true -> false (UI cleanup; ruleset is the binding gate)

scorecard.yml companion changes (in this PR):
- Added `pull_request: branches: [master]` trigger so the new required check
  actually reports on PRs. Without it, every PR would block forever waiting
  for Scorecard analysis that never runs.
- Gated `publish_results: ${{ github.event_name == 'push' }}` — PR runs
  publish a branch-HEAD SHA not on master, triggering the same OpenSSF
  webapp "imposter commit" 400 we hit in PR #15 (different cause, same
  SHA-not-on-commit-graph failure mode).

Deferrals documented in CHANGELOG:
- Items #6 + #7 (secret-scanning non_provider_patterns + validity_checks)
  require GHAS license; PATCH calls silently no-op on free tier (confirmed
  empirically on svgedit). Deferred indefinitely.

…dit Item 43) (#63)

* fix(cameras): RTSP probe authenticates with Digest, never preemptive Basic

The RTSP DESCRIBE probe base64'd the URL userinfo into an `Authorization:
Basic` header on the FIRST request, before any challenge. That leaks a
trivially-reversible password — over the unencrypted TCP/554 channel — to
whatever answers the socket, including a hostile device answering network
discovery.

Now the probe sends an unauthenticated DESCRIBE first and only answers an
explicit `WWW-Authenticate: Digest` challenge (RFC 2617, qop=auth + legacy
no-qop), which puts only a realm+nonce-bound hash on the wire, never the
password. We deliberately do NOT fall back to Basic: a Basic-only server
stays a 401 rather than re-leaking the password. Userinfo is now split and
percent-decoded (the old Basic path sent the still-encoded form), and the
response is read in a loop to the full Content-Length instead of a single
8 KiB chunk.

The test issues a Digest challenge and independently recomputes the expected
response from the client's Authorization header, asserting the first request
carried no credentials and the client never sends Basic.

Review finding #6 (2026-06-14 security/code-review audit).

* fix(email): enforce SMTP TLS via MailKit (no cleartext fallback)

EmailService used the obsolete System.Net.Mail.SmtpClient with EnableSsl,
which cannot do implicit TLS (SMTPS / port 465) and gives no explicit control
over the connection's security mode.

Replace it with MailKit. Port 465 now uses SecureSocketOptions.SslOnConnect
(implicit TLS); every other port uses SecureSocketOptions.StartTls, which
requires the server to offer STARTTLS and throws rather than continuing in
cleartext. The mode is chosen by ResolveSecureSocketOptions, unit-tested to
never return None, Auto, or StartTlsWhenAvailable — the options that would
permit a cleartext session.

Adds MailKit 4.17.0.

Review finding #7 (2026-06-14 security/code-review audit).

* fix(cameras): pool Hikvision ISAPI HTTP via IHttpClientFactory

HikvisionIsapiClient newed up an HttpClientHandler + HttpClient on every
probe and disposed them, leaking a socket per call. A camera scan across a
subnet could exhaust ephemeral ports.

Switch to IHttpClientFactory (the pattern already used by OnvifClient,
JellyfinService, DependencyManagerService, ...), which recycles a shared
SocketsHttpHandler so connections pool across probes. Because credentials
can't live on a shared handler, auth is now applied per request: an
unauthenticated GET first, then an answer to the 401 Digest (preferred) or
Basic challenge — preserving support for both older firmware (V5.6.2, which
requires Digest) and newer firmware (Basic), with no preemptive credentials.

The Digest/Basic header construction is extracted to a shared
DigestAuthHelper (the digest math is identical to the RTSP probe's). Tests
mock IHttpClientFactory and drive both challenge→200 flows, independently
recomputing the Digest response to confirm correctness.

Review finding #25 (2026-06-14 security/code-review audit).

* refactor(cameras): RTSP probe shares the DigestAuthHelper

RtspProbeClient carried its own copy of the RFC 2617 Digest construction
(ParseAuthParams / BuildDigestAuthorization / Md5Hex), identical to the
helper extracted for the Hikvision client. Point it at the shared
DigestAuthHelper and delete the duplicates. No behavior change — the RTSP
probe tests stay green.

* fix(utilities): FileUnblock uses -LiteralPath (no wildcard interpretation)

UnblockDirectoryAsync built `Get-ChildItem '<path>'` and `Get-Item
$_.FullName` with no -LiteralPath, so a directory or file name containing
'[' or ']' (e.g. C:\Photos\[2024]\) was parsed as a PowerShell wildcard
character class and silently matched nothing — the unblock quietly did
nothing for those paths.

Add -LiteralPath to both cmdlets. The single-quote doubling stays (it guards
quote injection, orthogonal to wildcards); the piped Unblock-File already
binds via PSPath, which is literal.

Review finding #12 (2026-06-14 security/code-review audit).

* fix(scrcpy): accumulate multi-frame WebSocket probe responses

ScrcpyProbeService.ProbeAsync read a single ≤8 KiB WebSocket frame and
deserialized it. A probe response with a long videoEncoders/audioEncoders
list exceeds one frame, so the JSON was truncated and deserialization
failed — the device silently reported no probe data.

Extract ReadFullTextMessageAsync, which loops ReceiveAsync until
EndOfMessage, assembling the full payload (with a 1 MiB safety cap and
Close/non-Text handling). Unit-tested with a scripted multi-frame WebSocket
to confirm a >8 KiB message reassembles and parses intact.

Review finding #22 (2026-06-14 security/code-review audit).

* fix(logging): Serilog provider no longer owns the global logger (dispose:false)

AddFileSink registered the SerilogLoggerProvider with dispose:true, so the
process-global Log.Logger was disposed whenever the host's logger factory was
disposed (host shutdown, or a second host built in the same process), tearing
down live logging for every other holder of Log.Logger. Nothing flushed the
file sink at process exit either.

- dispose:false: the configurator owns the logger lifetime, not the DI provider.
- Register an AppDomain.ProcessExit flush exactly once (idempotent across
  repeated inits) so buffered events reach disk at shutdown.
- Flush/close any previously-configured logger before replacing it, so a
  re-init doesn't leak the prior file handle.

Review finding #32 (2026-06-14 security/code-review audit).

* ci(dependabot): gate auto-merge on head-repo identity, not just actor

The auto-merge job ran on `github.actor == 'dependabot[bot]'` alone. Add
`github.event.pull_request.head.repo.full_name == github.repository` so the
PR's head branch must live in this repository — a fork PR can present the
author but never satisfies the head-repo check, closing the path where a
fork could ride auto-merge.

Review finding #18 (2026-06-14 security/code-review audit).

* fix(executor): default timeout for bundled-binary invocations

The executor kills a child process tree on cancellation, but the
ExecuteResolvedAsync callers (adb, magick/vtracer/potrace, sqlite3, the
--version probes) passed no deadline. A hung child therefore blocked the
awaiting Blazor circuit indefinitely.

Add an optional `timeout` to both ExecuteResolvedAsync overloads, backed by a
generous DefaultCommandTimeout (5 min) when unspecified, implemented as a
linked CTS + CancelAfter. On expiry the existing kill-on-cancel tears down the
child tree and we return a TimedOut CommandResult; a caller-driven
cancellation still propagates as OperationCanceledException. Long-running
processes (go2rtc, scrcpy, ws-scrcpy-web) are supervised elsewhere and don't
use this path, so the backstop can't clip them.

Review finding #19 (2026-06-14 security/code-review audit).

* docs: D2 dependency-integrity writeup + network/robustness changelog

Lands the documentation deferred from the D2 PR (#62, master is PR-gated):

- CHANGELOG [Unreleased]: the runtime dependency-download integrity gate
  (transport hard-gate → pinned SHA-256 → upstream checksum → Authenticode →
  user-confirm), plus the eight network/robustness findings from this branch.
  Trims the now-stale "still needs an integrity strategy" note on the
  dotnet-install entry.
- TECHNICAL_GUIDE: rewrites DownloadAndInstallAsync to verify-before-extract,
  documents the tiered IArtifactVerifier gate and the SharpCompress `.7z`
  extraction (which un-inerts ImageMagick's portable auto-update).
- README: one line noting downloads are integrity-verified before install.

* test: relax executor token matchers for the default-timeout wrapper

ExecuteResolvedAsync now runs commands under a linked CTS (the #19 default
timeout), so the executor sees that linked token rather than the caller's
CancellationToken.None. Tests that mocked ExecuteAsync with an exact `default`
token (adb, sqlite3, adb kill-server) stopped matching — their Setups missed
(null result) and Verifies saw zero invocations.

Relax those token arguments to It.IsAny<CancellationToken>(); the command name,
argument list, and working directory are still asserted exactly. The raw-executor
paths (docker, --version probes) are unwrapped and keep their exact tokens.

* docs: note MD5-sess scope + RTSP connection-reuse (code-review polish)

Two clarifying comments from the whole-branch review (no behavior change):
- DigestAuthHelper computes plain-MD5 HA1 only; MD5-sess is intentionally
  unsupported (unseen on IP cameras, fail-closed over untested crypto).
- The RTSP authenticated retry reuses the open connection per convention; a
  server that closes after 401 degrades to a graceful probe failure.