Add pull request checks for Django, Docker, protobuf and React

[jamesmulcahy]

Adds pull request checks for the parts of the repo that CI didn't cover: the Django code, the Docker image, the generated protobuf code and the React components. It goes with #388 (Django tests) and #392 (MQTTManager tests). Each check is its own commit, so any of them can be dropped.

Checks

Workflow	Runs on changes to	Fails when
Django checks (django-checks.yml)	docker/web/, docker/ruff.toml	ruff finds an undefined name or syntax error (F821, E9); manage.py check reports a problem; a model change has no migration (makemigrations --check)
Docker build (docker-build.yml)	docker/	The release image doesn't build. Pull requests and pushes build amd64 and aarch64. A weekly run, which can also be started by hand, adds armv7, armhf and i386. Nothing is pushed.
Protobuf (protobuf.yml)	.proto files, generated code, conanfile.py, requirements.txt	The committed C++, Python or firmware C code differs from what compile_all.sh generates; or protoc, the Conan package and the Python package aren't the same protobuf release
React components (react-components.yml)	web/react-components/	tsc -b or vite build fails, or the committed dist/ and templates/scripts.html differ from a fresh build. ESLint runs but doesn't fail the job yet.

Fixes and other changes

• Undefined names (0473cc36). Ruff's F821 found 11:
  • Feat first page react #391 removed the NSPanelRoomEntitiesPages component, but ten htmx views still built one to render their response. Each raised NameError and returned 500. Nothing in the templates, static JS or React code calls them any more, so this removes them, their routes, and handle_entity_modal_result, which only dispatched to one of them.
  • scenes_post looked lights up through a Light model that no longer exists, so POST /rest/scenes failed for any request with light states. It now looks them up in Entity, filtered to lights.
• docker/ruff.toml lists its rules. It never set select, so the rules came from whichever ruff was installed: 0.8 reports 102 findings, 0.16 reports 394. It now lists ruff's long-standing defaults (E4, E7, E9, F) and excludes the generated migrations and protobuf modules. CI pins ruff 0.16.10. 82 findings remain, mostly unused imports, so only F821 and E9 fail the build for now.
• Conan cache mount in the Dockerfile. The release build compiles every Conan dependency from source, which takes about an hour. The Conan package cache is now a BuildKit cache mount, which CI saves between runs with actions/cache and buildkit-cache-dance, one cache per architecture. Cold builds, including releases, behave as before. Local rebuilds now reuse the packages.
• Web UI pinned (6fd9f0ce). The ui-builder stage cloned NSPanelManager-Web-UI at whatever its main held at build time. It now checks out WEB_UI_REF, which defaults to the current head of main (6f3eae63). Shipping a UI change now means bumping that commit here. --build-arg WEB_UI_REF=main builds the latest UI. This changes how UI updates reach a release, so it's a separate commit and easy to drop.
• compile_all.sh's output directories can be set from the environment, with the same defaults, so CI can generate into the checkout.

Current state

• The committed React build and the generated C++/Python protobuf code both match a fresh build exactly. There are no missing migrations, and manage.py check passes.
• bun.lock is out of date: it lacks every runtime dependency added since May, and bun install --frozen-lockfile fails. package-lock.json matches package.json, so CI installs with npm ci.
• ESLint reports 30 errors, mostly no-explicit-any and react-refresh/only-export-components.

Notes

• Conflicts with Add a Django test harness and initial REST API tests #388. Add a Django test harness and initial REST API tests #388 edits some of the htmx views removed here, so whichever merges second will conflict in htmx.py and urls.py. With the same removal applied on top of Add a Django test harness and initial REST API tests #388, its suite passes (219 tests, 1 expected failure).
• Required checks. All the workflows use paths: filters. If any of them becomes a required check, a pull request that doesn't touch those paths will wait for it forever.
• First Docker build. The first run of each architecture fills the Conan cache, which takes about an hour.
• Not verified locally. The Docker build and the firmware C part of the protobuf check have only run through actionlint. This draft is their first real run.

🤖 Generated with Claude Code