fix(scenes): persist app scene validity reports

[Lash-L]

The app sends PUT /user/scene/validity reports containing scene IDs and extra.invalidActions, but the local server currently acknowledges them through the fallback handler and discards the report. Add a dedicated handler that persists these client-reported action IDs in existing scene metadata while preserving scene actions, parameters, enablement, other extra fields, and the success response now observed from the real cloud API.

Each valid entry is processed independently. Unsupported entries and malformed stored metadata are skipped with sanitized diagnostics; blank or null stored metadata accepts updates. Missing invalidActions leaves state unchanged, and an explicit empty list clears the report. Unknown scene IDs create no records. Existing object metadata retains its type, and repeated reports avoid writes. The existing /user/ Hawk authentication gate applies.

The scene metadata update runs within the shared inventory transaction and uses the atomic writer from #152. The shared dependency #152 is now merged into main. Write failures are logged while preserving the existing acknowledgement.

Evidence: two recent phone requests used this endpoint and the Android app's PartialScene.decode consumes invalidActions as action IDs. On 2026-10-10, the exact app request bytes were replayed to PUT https://api-us.roborock.com/user/scene/validity using its matching saved cloud session and a fresh Hawk timestamp/nonce. The original captured Hawk signature verified. The cloud returned HTTP 200, application/json, with {"api":null,"result":null,"status":"ok","success":true}. The handler now matches this body exactly; a sanitized response fixture and documentation capture the evidence. Cloud persistence has not been verified. Follow-up probes established malformed/non-array JSON returns HTTP 400 with {"code":"parameter.error","msg":"parameter error","status":"BAD_REQUEST","timestamp":"..."}; missing authentication returns HTTP 401 with code auth.err, msg auth.err.invalid.token, status UNAUTHORIZED and a timestamp. Both error envelopes omit api and result. Unknown scene IDs and a string invalidActions value on an unknown scene still returned HTTP 200 with the normal success envelope. This does not establish behavior for malformed metadata on an existing scene. This stores client reports and does not perform server capability verification or change scene execution. Malformed/non-array bodies now receive the observed HTTP 400 error envelope. The existing Hawk gate uses the observed HTTP 401 envelope for this endpoint; authentication responses of other endpoints are unchanged.

Validation: 64 initial focused tests passed across scene validity, scene deletion, routine execution, protocol authentication, inventory serialization and inventory I/O. Regressions cover mixed valid/invalid batches, malformed and blank stored metadata, missing versus empty invalidActions, preservation of scene settings, sanitized diagnostics, idempotence and write failure. git diff --check passed. Nothing deployed.

Follow-up verification: 35 scene validity, scene deletion and inventory I/O tests passed after matching the verified cloud response. No cloud authentication material is included in the fixture or documentation.

Error-path verification: 51 scene, deletion, inventory and protocol-auth tests passed; all 5 HTTP response tests passed after adding the final invalid-action-type case. Exact cloud fixtures include successful, malformed-body and unauthenticated responses with dynamic timestamps checked separately.