feat(ssl): support self-signed HTTPS media/pages via verify_ssl + per-asset override - #3176

…-asset override

Web-hosted HTTPS assets served with a self-signed / untrusted-CA cert
rendered blank (forum "web content doesn't display"): the webview's
QNetworkAccessManager / QWebEngine rejected the cert, and the
reachability probe marked the asset unreachable so the viewer skipped
it. The device-wide verify_ssl setting was also vestigial — unexposed,
and its off-branch still verified.

- Fix url_fails: verify_ssl=off now actually disables verification
  (regressed to `verify=True` in 2019); add a per-call verify_ssl arg
- Add per-asset Asset.skip_ssl_verify (migration, v2 API, edit modal);
  reachability composes it with the device-wide verify_ssl
- Expose the device-wide verify_ssl toggle in Settings + v2 API
- Viewer computes the effective skip per asset and passes it to the
  webview's loadImage / loadPage D-Bus slots (video needs none —
  FFmpeg already tolerates self-signed)
- Webview: ignoreSslErrors on the image reply and an SSL-aware
  QWebEnginePage (Qt5 virtual override / Qt6 certificateError signal)
  when skip is set; compiles on both Qt5 and Qt6

Rebased onto master (single-view webview collapse #2954, per-asset
headers #2215, nocache #3137): merged the effective-skip flag through
view_webpage alongside headers/nocache, and threaded skipSslVerify
into the now-single AnthiasWebEnginePage. Adapted the viewer tests to
the two-arg loadPage/loadImage slots, pinned verify_ssl in the
reachability-sweep test so a host anthias.conf can't mask it, and added
a url_fails regression test for the verify_ssl toggle. Qt6 x86 webview
rebuilt clean on the dev host.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Address Copilot review. The suppression was a process-global
disable_warnings(), which silences InsecureRequestWarning for every
other verify=False request in the process once any probe runs it, not
just this reachability probe. Scope it to the HEAD/GET calls with
warnings.catch_warnings() so the prior filter state is restored on
exit.

Verified against a self-signed origin: the probe no longer surfaces
the warning to its caller, and an independent verify=False request
after it still warns (no process-wide leak). Drops the two
requests.packages.urllib3 type: ignore comments in favour of a direct
urllib3 import.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…alls

Address Copilot review. loadPage/loadImage gained a skipSslVerify
argument, but the viewer called the 2-arg slots unconditionally —
unlike setReloadInterval / setRequestHeaders, which already latch on a
version-skewed webview. A webview process still running the previous
binary (viewer container rotated to a newer image mid-rollout, webview
not yet restarted) exposes only the 1-arg slots, so the 2-arg call
would raise UnknownMethod (or a pydbus marshalling error) and take the
screen down on the core navigation path.

Add _load_via_webview: try the 2-arg call, and on any non-"gone" error
fall back to the legacy 1-arg call. If the fallback succeeds it was a
skew — latch the capability off (reset on every respawn, like the
sibling flags) and keep displaying, losing only the per-asset SSL skip
the old webview couldn't honour anyway. If the fallback also fails the
extra arg wasn't the problem, so re-raise the original error. Confirming
the skew empirically avoids brittle exception-string matching across
pydbus/Qt versions. Adds three regression tests (page + image fallback,
and re-raise when the 1-arg call also fails).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Address Copilot review. In _load_via_webview, when the 1-arg fallback
also fails, re-raise the original 2-arg exception with `from None` so
the fallback exception is dropped from the context — the traceback
points at the real cause instead of a confusing "during handling of
the above exception" chain, and `exc` keeps its own original traceback.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Address Copilot review. url_fails caught only (ConnectionError,
Timeout). SSLError is already covered (it subclasses ConnectionError),
but TooManyRedirects — which allow_redirects=True can hit — is a
RequestException that is NOT a ConnectionError, so a redirect loop on
an asset URL would escape and 500 asset creation instead of resolving
to the boolean 'unreachable' verdict. Catch requests.exceptions.
RequestException so every DNS / TLS / timeout / redirect failure maps
to True. Adds a parametrised regression test (SSLError + TooManyRedirects
+ Timeout + ConnectionError).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>