fix: pre-car-test bug fixes from full code audit

- app_alerts.py: null guard on list_local_videos() result (.get('files', []))
- app_cellular.py: remove erroneous .encode(errors='replace') on str response body
- app_settings.py: initialize apn='' when isinstance check fails (NameError guard)
- app_upload.py: move json import to top of file instead of inside except handler
- server/app.py: wrap int(request.args.get('limit')) in try/except ValueError
- server/app.py: wrap os.path.commonpath() in try/except ValueError (cross-root paths)
- tests/test_app_settings.py: add missing trips_upload_enabled/video_convert_enabled
  to valid_payload() (fields added in Phase 23.5 but test not updated)

All 63 tests pass.

Co-authored-by: Copilot <[email protected]>

server/app.py

@@ -430,7 +430,10 @@ def portal_trips():
     device_id = _portal_device_id()
     if device_id is None:
         return jsonify(error="device not configured"), 404
-    limit = min(int(request.args.get("limit", 200)), 1000)
+    try:
+        limit = min(int(request.args.get("limit", 200)), 1000)
+    except (ValueError, TypeError):
+        limit = 200
     return jsonify(db.list_trips(device_id, limit=limit))
 
 
@@ -452,7 +455,10 @@ def portal_dashcam_list():
     device_id = _portal_device_id()
     if device_id is None:
         return jsonify(error="device not configured"), 404
-    limit = min(int(request.args.get("limit", 500)), 2000)
+    try:
+        limit = min(int(request.args.get("limit", 500)), 2000)
+    except (ValueError, TypeError):
+        limit = 500
     return jsonify(db.list_dashcam_files(device_id, limit=limit))
 
 
@@ -468,7 +474,11 @@ def portal_dashcam_stream(file_id):
         abort(404)
     storage_path = file_row["storage_path"]
     # Safety check: must still be under STORAGE_DIR
-    if not os.path.commonpath([STORAGE_DIR, os.path.normpath(storage_path)]) == os.path.normpath(STORAGE_DIR):
+    try:
+        safe = os.path.commonpath([STORAGE_DIR, os.path.normpath(storage_path)]) == os.path.normpath(STORAGE_DIR)
+    except ValueError:
+        safe = False
+    if not safe:
         abort(403)
     if not os.path.isfile(storage_path):
         abort(404)