Improve QC normalization robustness, enforce JSON-safe API responses, and align local/devcontainer defaults

[joakimmoller]

Summary

This branch improves reliability across the Scan-o-Matic stack with a focus on three high-level areas:

1. QC normalization UI and API responses are now more resilient to malformed, empty, or non-finite data, reducing frontend rendering failures.
2. Local/development workflow is streamlined by aligning devcontainer and compose defaults with in-repo data paths and safer startup behavior.
3. Supporting quality updates were added across tests, docs, and dependency lockfiles.

High-Level Functionality Changes

• Normalization and QC views now handle empty/null/invalid plate and curve payloads more gracefully, with clearer user feedback instead of silent failures or broken charts.
• UI server responses are sanitized to ensure JSON-safe numeric values (for example NaN/Infinity are converted safely), preventing invalid payloads from reaching clients.
• Lock handling in QC endpoints is more robust for temporary/local lock recovery scenarios.
• Default runtime paths now favor local project directories for settings and project storage, improving local reproducibility and developer ergonomics.

What Changed

1) Image analysis robustness

• Added fallback loading for grayscale configuration from bundled defaults when user config is missing.
• Added unit test coverage for fallback behavior.

2) UI server path validation

• Safe directory-name validation now allows hyphens while still blocking traversal patterns.
• Added tests to verify accepted and rejected path patterns.

3) Data-processing tests

• Re-enabled the no-growth noise phenotype test that had been skipped.

4) API JSON safety and serialization hardening

• Introduced centralized JSON sanitization utilities and a safe JSON encoder for Flask responses.
• Sanitization now handles nested sequences/mappings, numpy scalars/arrays, enums, and non-finite floats.
• Applied sanitization across calibration/data/QC endpoints returning numeric matrices or derived values.
• Updated filter-array conversion logic to treat all non-finite values as null.
• Relaxed tuple/list compatibility in validation where model normalization can materialize tuple-like fields as lists.
• Fixture listing behavior was adjusted to keep a local fallback path while preserving online behavior.

5) QC normalization frontend improvements

• Hardened API helper parsing/error paths and null handling.
• Improved curve rendering guards for empty/misaligned/non-finite series and invalid plotting domains.
• Improved plate rendering guards for malformed matrices and missing metadata.
• Added clearer in-page info/error messaging for plate/graph rendering outcomes.
• Added style updates for new error/info UI states.

6) Devcontainer and local workflow alignment

• Updated devcontainer setup (name, workspace mount/folder, user handling, run args, post-start permission fix).
• Added persistent cache volumes and permission-fix logic for npm/uv caches.
• Post-create setup now builds frontend assets and performs full extras sync.
• Developer data defaults are initialized inside the repo for easier persistence/inspection.
• Replaced Python config-copy bootstrap script with shell-based recursive copy in entrypoint.
• Removed obsolete setup script and updated ignore rules for local data/project directories.

7) Dependency and docs maintenance

• Refreshed npm lockfile with transitive dependency updates.
• Normalized README heading hierarchy for clearer documentation structure.
• Updated compose defaults to use local directories for settings and project mounts.

Commit Coverage

• fix(image-analysis): add bundled grayscale config fallback
• fix(ui-server): allow hyphens in safe directory names
• test(data-processing): re-enable no-growth noise phenotype test
• docs(readme): normalize heading levels
• chore(deps): refresh npm lockfile
• chore(devcontainer): align container setup with local workflow
• fix(api): enforce JSON-safe responses in ui server
• feat(qc-ui): improve normalization views and interactions
• fix(docker-compose): use local defaults for volume mounts

Notes

• No breaking API contract is intended; changes are primarily defensive and compatibility-focused.
• This PR includes functional changes plus infrastructure/docs/dependency updates in a single branch.