Merge upstream/master + address KP13 round-1 review (asks 1-7)

Merge brings in homeassistant-ai#1126, homeassistant-ai#1135, homeassistant-ai#1136, homeassistant-ai#1138 and the dev-addon publish
chain since the branch's previous head `147ad5f`. Conflict in
`tests/src/unit/test_settings_ui.py` resolved by keeping both adjacent
additions: master's `test_returns_500_when_save_fails` (read-only-fs
500-surfacing test from homeassistant-ai#1138) inside `TestSaveToolsValidation`, plus
this PR's new `TestRestartAddon` class right after.

KP13 round-1 review asks (CHANGES_REQUESTED 2026-05-06 20:38 UTC) all
addressed:

1. **Narrow connection-drop catch** — the `except` tuple in
   `_restart_addon` (in `settings_ui.py`) is now
   `(httpx.ReadError, httpx.RemoteProtocolError)`. `httpx.ConnectError`
   is no longer treated as a successful restart; it falls through to
   the `httpx.HTTPError` handler returning 502 + `CONNECTION_FAILED`.
   Inline comment documents the deliberate exclusion (DNS /
   TCP-refused / supervisor-socket-misconfigured all mean Supervisor
   was unreachable, not that a restart was initiated).

2. **Parametrize connection-drop test** + separate `ConnectError` →
   502 case. `test_treats_connection_drop_as_success` now parametrizes
   over `(httpx.ReadError, httpx.RemoteProtocolError)`. New
   `test_connect_error_returns_502` locks the contract that a
   connection-failure-before-handshake surfaces as 502.

3. **Boy-Scout: pin remaining `_restart_addon` branches.** Two new
   tests: `test_generic_http_error_returns_502` (uses
   `httpx.PoolTimeout` to exercise the `httpx.HTTPError` fall-through)
   and `test_supervisor_4xx_returns_502` (Supervisor returns 401 →
   handler maps to 502).

4. **Symbol-based test docstrings** — class-docstring + method
   docstrings now reference "the `if not token:` guard", "the catch
   on `(ReadError, RemoteProtocolError)`", "the `httpx.HTTPError`
   handler", "the `status_code >= 400` branch" instead of line numbers
   that shift with every kwarg-split / refactor.

5. **Top-level `import httpx`** in `tests/src/unit/test_settings_ui.py`
   replaces the inline `__import__("httpx").ReadError(...)` workaround.

6. **Trim "post-G1 state"** from the `verify_ssl = True` fixture
   comment. Kept the substantive part ("must resolve to a real bool,
   not a MagicMock, because httpx accepts only bool/SSLContext for
   `verify=`") that pays off in 6 months.

7. **Move homeassistant-ai#960 cross-reference** out of the `TestRestartAddon` class
   docstring. Closed-PR review history rots fast in source; the PR
   body is the right place for it.

Local: 1762 unit tests pass, ruff lint + format clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Patch76