fix: pre-car-test bug fixes from full code audit

- app_alerts.py: null guard on list_local_videos() result (.get('files', []))
- app_cellular.py: remove erroneous .encode(errors='replace') on str response body
- app_settings.py: initialize apn='' when isinstance check fails (NameError guard)
- app_upload.py: move json import to top of file instead of inside except handler
- server/app.py: wrap int(request.args.get('limit')) in try/except ValueError
- server/app.py: wrap os.path.commonpath() in try/except ValueError (cross-root paths)
- tests/test_app_settings.py: add missing trips_upload_enabled/video_convert_enabled
  to valid_payload() (fields added in Phase 23.5 but test not updated)

All 63 tests pass.

Co-authored-by: Copilot <[email protected]>

modules/app_upload.py

@@ -35,6 +35,7 @@ never commit real values - mirrors the db/creds.env pattern already used by
 app_db.py for MongoDB).
 """
 import hashlib
+import json
 import os
 import time
 from threading import Thread
@@ -178,9 +179,7 @@ def _upload_tracking_batch():
         if not app_cellular.is_configured():
             raise
         print(f"WiFi/Ethernet upload unreachable ({wifi_err}), trying cellular fallback...")
-        import json as _json
-
-        body_bytes = _json.dumps({"points": points}).encode()
+        body_bytes = json.dumps({"points": points}).encode()
         try:
             status_code, _body = app_cellular.http_post_json(
                 f"{SERVER_URL}/api/v1/tracking/batch", body_bytes, _headers()