feat: rename to FabledScryer, multi-dashboard system, plugin management, branding

- Rename package fablednetmon → fabledscryer throughout
- Multi-dashboard: ownership, per-user defaults, HTMX edit (add/remove/reorder)
- Read-only share tokens scoped to individual dashboards
- Dashboard edit is HTMX-driven (no page reloads)
- Plugin management system: remote catalog, download/install, hot-reload, in-app restart
- plugin_index.py: fetch/cache remote index.yaml; default URL → bvandeusen/fabledscryer-plugins
- plugin_manager.py: download_and_install_plugin, hot_reload_plugin, restart_app
  - ZIP extraction handles GitHub archive formats (name-v1.0.0/, name-main/)
- Settings split into tabbed sections: General, Notifications, Ansible, Plugins
- Plugins tab: catalog browser (HTMX), install/activate/update/restart actions
- UI/branding: dark palette (#07071a), crystal ball SVG logo, animated star field,
  Libertinus Serif applied to headings, nav, labels, and section titles
- Widget registry (core/widgets.py) for dashboard plugin integration
- UPS widget.html (dashboard card) and settings/_tabs.html include
- Migrations 0005–0008: dashboards, is_default, ownership, share tokens
- docs/plugins/: writing-a-plugin.md updated with publishing guide,
  index.yaml.example template for fabledscryer-plugins repo

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fabledscryer/config.py

@@ -0,0 +1,81 @@
+# fabledscryer/config.py
+from __future__ import annotations
+import logging
+import os
+import secrets
+from pathlib import Path
+from typing import Any
+
+logger = logging.getLogger(__name__)
+
+_SECRET_KEY_FILE = Path("/data/secret.key")
+
+
+def load_bootstrap(config_path: Path | str | None = None) -> dict[str, str]:
+    """Return the minimum bootstrap config: database_url and secret_key.
+
+    This is the only config read from files/env vars at startup.
+    Everything else is stored in the app_settings DB table.
+
+    config_path is optional — used only for backwards compatibility with
+    existing config.yaml deployments. The file is not required.
+    """
+    from dotenv import load_dotenv
+    load_dotenv()
+
+    raw: dict[str, Any] = {}
+    if config_path is None:
+        config_path = Path("config.yaml")
+    config_path = Path(config_path)
+    if config_path.exists():
+        import yaml
+        with config_path.open() as f:
+            raw = yaml.safe_load(f) or {}
+
+    database_url = (
+        os.environ.get("FABLEDSCRYER_DATABASE_URL")
+        or os.environ.get("FABLEDSCRYER_DATABASE__URL")
+        or raw.get("database", {}).get("url")
+    )
+    if not database_url:
+        raise ValueError(
+            "Database URL is required. Set FABLEDSCRYER_DATABASE_URL env var "
+            "or add 'database.url' to config.yaml."
+        )
+
+    secret_key = _resolve_secret_key(raw)
+    plugin_dir = (
+        os.environ.get("FABLEDSCRYER_PLUGIN_DIR")
+        or raw.get("plugin_dir", "plugins")
+    )
+
+    return {
+        "database_url": database_url,
+        "secret_key": secret_key,
+        "plugin_dir": plugin_dir,
+    }
+
+
+def _resolve_secret_key(raw: dict) -> str:
+    """Resolve secret_key: env var → file → auto-generate."""
+    from_env = os.environ.get("FABLEDSCRYER_SECRET_KEY") or raw.get("secret_key")
+    if from_env:
+        return from_env
+
+    if _SECRET_KEY_FILE.exists():
+        key = _SECRET_KEY_FILE.read_text().strip()
+        if key:
+            return key
+
+    key = secrets.token_hex(32)
+    try:
+        _SECRET_KEY_FILE.parent.mkdir(parents=True, exist_ok=True)
+        _SECRET_KEY_FILE.write_text(key)
+        logger.info("Generated new secret key and saved to %s", _SECRET_KEY_FILE)
+    except OSError as exc:
+        logger.warning(
+            "Could not write secret key to %s (%s). "
+            "Key will not persist across restarts.",
+            _SECRET_KEY_FILE, exc,
+        )
+    return key