Backport changes from Pro (#1957)

Resolves https://github.com/tiny-pilot/tinypilot-pro/issues/1925

The PR backports outstanding changes from Pro into Community.

### Notes

- I followed a mostly manual process of:
  1. Copying the Pro `.git` directory in the Community repo
  1. Using VSCode to accept/reject Pro changes into the Community repo
  1. Restoring the Community `.git` directory
  1. Commit and push changes
  1. Installing the bundle on a Raspberry Pi device
     - keyboard, video, and mouse works
 - These changes include:
- Pin GitHub actions to a commit SHA instead of a tag because tags can
silently change to a new commit without us knowing
    - Non-functional changes to absolute mouse related code
    - Severing the bind between nginx and tinypilot systemd services:
       - https://github.com/tiny-pilot/tinypilot-pro/pull/1920
    - Prevent TLS certs from cycling twice on first install:
       - https://github.com/tiny-pilot/tinypilot-pro/pull/1924
- Prevent `tinypilot-updater` from stopping itself during an upgrade:
       - https://github.com/tiny-pilot/tinypilot-pro/pull/1916
- Merging this PR should generate an empty diff when merging back into
Pro

<a data-ca-tag
href="https://codeapprove.com/pr/tiny-pilot/tinypilot/1957"><img
src="https://codeapprove.com/external/github-tag-allbg.png" alt="Review
on CodeApprove" /></a>

Fix pip install procedure (#1942)

Backport of https://github.com/tiny-pilot/tinypilot-pro/pull/1773.

<a data-ca-tag
href="https://codeapprove.com/pr/tiny-pilot/tinypilot/1942"><img
src="https://codeapprove.com/external/github-tag-allbg.png" alt="Review
on CodeApprove" /></a>

---------

Co-authored-by: Jan Heuermann <jan@jotaen.net>

Add script for checking USB data connection (#1925)

Resolves https://github.com/tiny-pilot/tinypilot-pro/issues/1636.

This PR adds a script for determining the status of the USB data
connection, based on the power state. (See docstring comment.)

Note that in contrast to the [HDMI check
script](#1924), we don’t
need root privileges here, so the script can live in
`/opt/tinypilot/scripts`. Otherwise, the mechanics of the script are
equivalent. I’ve also added the info to the debug logs, just in case and
mostly for the sake of completeness.

<img width="824" height="902" alt="Screenshot 2025-10-20 at 19 53 13"
src="https://github.com/user-attachments/assets/ab471090-e612-44f0-97d3-597b84bfc890"
/>
<a data-ca-tag
href="https://codeapprove.com/pr/tiny-pilot/tinypilot/1925"><img
src="https://codeapprove.com/external/github-tag-allbg.png" alt="Review
on CodeApprove" /></a>

---------

Co-authored-by: Jan Heuermann <jan@jotaen.net>

Update network-status-interface elements in-place (#1923)

Resolves https://github.com/tiny-pilot/tinypilot-pro/issues/1648

This PR updates each network-status-interface element in-place, on the
network-status-dialog, to avoid a brief flash of unstyled content (FOUC)
that seems to be an [issue with native Web
Components](https://stackoverflow.com/questions/62683430/how-to-stop-fouc-from-happening-with-native-web-components).

<a data-ca-tag
href="https://codeapprove.com/pr/tiny-pilot/tinypilot/1923"><img
src="https://codeapprove.com/external/github-tag-allbg.png" alt="Review
on CodeApprove" /></a>

Update license paths (#1898)

Resolves #1897 

This change updates the paths to the PyYaml and MarkupSafe Python
dependency licenses.

<a data-ca-tag
href="https://codeapprove.com/pr/tiny-pilot/tinypilot/1898"><img
src="https://codeapprove.com/external/github-tag-allbg.png" alt="Review
on CodeApprove" /></a>

---------

Co-authored-by: Jason Wallace <jdeanwallace@gmail.com>

Backport changes from Pro (#1868)

Resolves https://github.com/tiny-pilot/tinypilot-pro/issues/1467.

This PR isn’t urgent.
<a data-ca-tag
href="https://codeapprove.com/pr/tiny-pilot/tinypilot/1868"><img
src="https://codeapprove.com/external/github-tag-allbg.png" alt="Review
on CodeApprove" /></a>

Co-authored-by: Jan Heuermann <jan@jotaen.net>

Support German (de-DE) keyboard layouts when pasting (#1842)

This PR adds a detection mechanism for the German `de-DE` locale in the
paste feature. In this case, it uses the correct mapping, and ensures
that all characters come through correctly.

## Original PR description

Hi, 
I added the translation table for German Special Characters. 
The Manual definition of `ALT_GR` is necessary since on german layouts
the `AltGr` Key doesnt behave like the `MODIFIER_RIGHT_ALT`. In
Tinypilot, pressing `AltGr` is interpreted like `Ctrl Left + Alt Right`
which translates to hex `0x41`, but it should be `Ctrl Left + Alt Left`
(Hex `0x05`) to work for German Special Characters.

Closes #1830
 
For an Quick overview for anyone later reading this, this would support
the following special Characters:
```
!"§$%&(){}[]/+*#'-_.:,;äöüÄÖÜ<>|€?ß\~`´
```

Greetings from Germany :)
<a data-ca-tag
href="https://codeapprove.com/pr/tiny-pilot/tinypilot/1842"><img
src="https://codeapprove.com/external/github-tag-allbg.png" alt="Review
on CodeApprove" /></a>

---------

Co-authored-by: Jan Heuermann <jan@jotaen.net>

Upgrade pip dependencies (#1802)

Resolves https://github.com/tiny-pilot/tinypilot-pro/issues/1336.

This PR upgrades a few of our Python dependencies. Coincidentally, all
license paths were slightly changed for these packages.

@jdeanwallace it would be cool if you could briefly QA this on device as
well, just as a quick double-check.
<a data-ca-tag
href="https://codeapprove.com/pr/tiny-pilot/tinypilot/1802"><img
src="https://codeapprove.com/external/github-tag-allbg.png" alt="Review
on CodeApprove" /></a>

Co-authored-by: Jan Heuermann <jan@jotaen.net>

Check for unnecessary privilege escalation (#1743)

Resolves https://github.com/tiny-pilot/tinypilot-pro/issues/1214
<s>Blocked by https://github.com/tiny-pilot/tinypilot/pull/1744</s>
<s>Blocked by https://github.com/tiny-pilot/tinypilot/pull/1745</s>

This PR adds a dev script that checks for possible cases of privilege
escalation in tinypilot-writable scripts (i.e., `scripts/`).

The script only does a superficial check that root privileges were at
least considered by matching on:
> This script doesn't require root privileges.

Example output of `dev-scripts/check-privilege-guard`:
```
$ ./dev-scripts/check-privilege-guard 
These files are missing a guard against privilege escalation:
scripts/is-ssh-enabled
scripts/streaming-mode
scripts/update-service
scripts/upgrade
Please add the following check (or similar) to the above scripts:
if [[ "${EUID}" == 0 ]]; then
  >&2 echo "This script doesn't require root privileges."
  >&2 echo 'Please re-run as tinypilot:'
  >&2 echo "  runuser tinypilot --command '$0 $*'"
  exit 1
fi
```

Notes

1. <s>These tinypilot-writable scripts legitimately require root
privileges:
    * `scripts/install-bundle`
    * `script/upgrade`
   
So they do risk being used for privilege escalation, but they are/should
never be executed by privileged scripts on the device.
    
    I've also added a superficial check for this too.</s>
2. This PR also fixes the privilege escalation issues that
`dev-scripts/check-privilege-guard` as picked up. As a reminder, the fix
is a runtime error asking for reduced permissions which is something
we'll only encounter when we physically test the device. So as a result,
this PR also tries to avoid those runtime errors by running these
identified scripts as `tinypilot` where needed:
    ```
    runuser tinypilot --command '/opt/tinypilot/scripts/some-script'
    ```

<a data-ca-tag
href="https://codeapprove.com/pr/tiny-pilot/tinypilot/1743"><img
src="https://codeapprove.com/external/github-tag-allbg.png" alt="Review
on CodeApprove" /></a>

Add "Pro" stub for Static IP feature (#1675)

Resolves #1673



https://github.com/tiny-pilot/tinypilot/assets/6730025/27a4b1ed-b104-4151-a391-9c7c1468101b


<a data-ca-tag
href="https://codeapprove.com/pr/tiny-pilot/tinypilot/1675"><img
src="https://codeapprove.com/external/github-tag-allbg.png" alt="Review
on CodeApprove" /></a>