luci-theme-footstrap: sync with release 0.14.13

[VizzleTF]

Pull request details

Description

Sync luci-theme-footstrap with its 0.14.13 release. The last sync was #8981; this carries ten releases of fixes and two features on top of it, in one commit.

• Appearance is a page of its own, admin/system/footstrap, dispatched from menu.d like any other view. It replaces the tab the theme used to staple onto luci-mod-system's form, and with it go the MutationObserver, the 5 s deadline and the sessionStorage return key that mounting needed.
• The reader's place survives a poll refill — on all three engines, in both scrollers and at every density, with Back returning to where the reader was on a phone as well as a desktop. The Overview no longer creeps a few pixels per poll tick.
• The wallpaper uploads move into a module of their own (fs-assets.js, out of fs-prefs.js, ~4 KB off every other page), and the SVG sanitiser is hardened — it now decides on the parsed document, closes xml:base and a CSS hex-escape hiding url(), and sanitizes where it used to refuse.
• The pattern is served by a CGI handler, with Content-Security-Policy: default-src 'none'; sandbox and nosniff, instead of the /www symlink it used to be — opened directly, that symlink was a same-origin document with the admin's session reachable from it. The handler takes no request input; uci-defaults removes the stale symlink. The login background stays a plain symlink: it has no extension, so uhttpd answers application/octet-stream, which a browser downloads rather than runs.
• A fifth colourway, forum, wearing the OpenWrt forum's scheme, and the content column's 1280 px cap is now the reader's to move.
• Overview cards collapse from the keyboard, their own heading is the control, and a meter colours by its own reading rather than by fill — "Swap free" warns low, "Buffered"/"Cached" never colour.
• postinst and postrm no longer call rpcd reload. A reload is a re-exec that re-dlopen()s every plugin, and one absent or mid-write at that moment is dropped for good — losing file that way silently removes System → Backup / Flash Firmware's "Reset to defaults" row. rpcd reads acl.d/*.json at login, so nothing here needed the reload; a session that predates the install is ended instead, and only when re-authenticating would actually grant it the theme's scope.
• Plus the smaller fixes of those ten releases: a toggle knob outside its pill, a dropdown value cut mid-glyph, a TypedSection header clipping at 1024 px, a WireGuard key running past its box, a checkbox with a tooltip drawing a second dead switch, a foreign app's hidden lg:flex hiding on wide screens, and the Russian-only overflow faults a pseudo-localised sweep found.

po/ is untouched — Weblate owns it.

Developed at https://github.com/VizzleTF/luci-theme-footstrap

Screenshot or video of changes (if applicable)

Maintainer (preferred)

@VizzleTF

---

Tested on

OpenWrt version: OpenWrt 25.12.4 (apk) and OpenWrt 24.10.8 (opkg), x86_64 containers
LuCI version: this branch, built with the x86_64 master and 24.10 SDKs
Web browser(s): Chromium 151, Firefox 145, WebKit/Safari 26

[openwrt-ai]

Commit checks

• 2936c8c "luci-theme-footstrap: sync with release 0.14.13" — the body lists "uploads for the login background and the wallpaper pattern" among what this adds, but fs-prefs.js at the base already carries uploadPattern, _sanitizeSvg, _downscale/BG_MAX_SIDE and the cgi-upload POST. The diff extracts them into fs-assets.js and hardens the sanitiser; say extracted/hardened rather than added (same wording in the PR body).

---

Generated by Claude Code

[openwrt-ai]

Reviewed 1 new commit.

---

Generated by Claude Code

[openwrt-ai]

Reviewed 1 new commit; no new issues found.

---

Generated by Claude Code

[VizzleTF]

@hnyman take a look please