fix: pre-car-test bug fixes from full code audit

- app_alerts.py: null guard on list_local_videos() result (.get('files', []))
- app_cellular.py: remove erroneous .encode(errors='replace') on str response body
- app_settings.py: initialize apn='' when isinstance check fails (NameError guard)
- app_upload.py: move json import to top of file instead of inside except handler
- server/app.py: wrap int(request.args.get('limit')) in try/except ValueError
- server/app.py: wrap os.path.commonpath() in try/except ValueError (cross-root paths)
- tests/test_app_settings.py: add missing trips_upload_enabled/video_convert_enabled
  to valid_payload() (fields added in Phase 23.5 but test not updated)

All 63 tests pass.

Co-authored-by: Copilot <[email protected]>

modules/app_alerts.py

@@ -231,7 +231,7 @@ def _power_condition(throttling, now=None):
 def collect_conditions(config):
     health = app_health.collect_health()
     videos = app_video.list_local_videos()
-    pending_videos = sum(1 for video in videos["files"] if not video["uploaded"])
+    pending_videos = sum(1 for video in (videos or {}).get("files", []) if not video["uploaded"])
     pending_tracking = app_sql.count_unsent_tracking_rows()
     speed = app_obd.get_fresh_speed()
     fix_age = app_gps.get_fix_age()