Fix mutable defaults, security hardening, and bug fixes

[pjleduc]

Summary

• Mutable default arguments: Replace dangerous =[] / ={} defaults with =None pattern across 9 files (display_manager, abstract_display, inky_display, mock_display, waveshare_display, image_utils, base_plugin, app_utils, config)
• Security hardening: Strip newlines in API key values to prevent .env injection, replace os.system() with subprocess.Popen() for reboot/shutdown, use os.urandom() for Flask secret key, narrow bare except to except OSError
• Bug fixes:
  • Calendar plugin: skip failed calendar URLs gracefully instead of crashing the entire plugin (fixes blank screen when one URL times out)
  • Weather plugin: fix Open-Meteo forecast off-by-one day label bug (same fix as Fix day label off-by-one in parse_open_meteo_forecast #613 — Open-Meteo returns local dates, not UTC)
  • Model: remove duplicate scheduled refresh logic that could cause incorrect refresh behavior
  • Refresh task: add 60s timeout to refresh_event.wait() to prevent indefinite hangs on manual updates
  • Plugin blueprint: return 400 instead of crashing with KeyError when plugin_id missing from form data

Test plan

• Tested on Raspberry Pi Zero 2 W with Inky e-ink display (800x480)
• All plugins (weather, calendar, RSS, comics, clock, etc.) confirmed working after changes
• Calendar plugin correctly skips failing Outlook URLs and renders remaining calendars
• Weather plugin shows correct day labels with Open-Meteo provider
• Service runs stable for 48+ hours with no errors from these changes

🤖 Generated with Claude Code