feat: add optional login_passcode for passcode-protected profiles

[bayan9]

Problem

standby/wake shell out to the playactor CLI. When the PlayStation user profile used for pairing is passcode-protected, playactor's remote-play login requires that passcode and otherwise fails with PASSCODE_IS_NEEDED (remoteplay/proc/login.js). In practice this is intermittent — it depends on the console's state at the moment of the command — so power control "usually works" but randomly leaves the console awake/asleep. There is currently no way to supply the profile login passcode, so passcode-protected profiles can't be reliably controlled.

Change

Add an optional login_passcode option, forwarded to playactor's --pass-code on the standby and wake commands.

• Add-on: new login_passcode: str? in both ps5-mqtt and ps5-mqtt-edge config.yaml schemas (reaches the server via the existing CONFIG_PATH/options.json).
• Docker: new LOGIN_PASSCODE env var (parsed in config.ts).
• Plumbed through AppConfig → Settings → the turn-on/turn-off sagas.
• A small buildPassCodeArg() helper builds the --pass-code '<value>' fragment. It accepts playactor's documented formats (a numeric passcode, or a space-separated string of key names), validates against ^[A-Za-z0-9 ]+$, and single-quotes the value — so a malformed/hostile value can't inject into the shell command. Unset ⇒ no change in behavior.
• Unit tests for the helper (incl. injection guards); docs updated (DOCS.md, DOCKER.md).

Notes / scope

• A single passcode applies to all managed devices. Multiple consoles with different profile passcodes aren't covered (documented). Happy to extend to per-device if you'd prefer that shape.
• Alternative for users: disabling the profile passcode on the console avoids the error entirely; this option is for those who want to keep it.

Testing

• buildPassCodeArg unit tests added; verified the parsing/validation/injection-guard behavior, and the helper typechecks clean under --strict.
• Existing config.test.ts stays green (login_passcode is undefined when unset, which lodash.merge skips).
• Disclosure: I couldn't run the full yarn workspace build in my environment; please let CI exercise typecheck + the suite. Happy to adjust naming (e.g. login_passcode vs per-account) or approach.

[bayan9]

Runtime-tested this branch on real hardware (HA OS Supervisor add-on, amd64) — it resolves the intermittent PASSCODE_IS_NEEDED for a passcode-protected PS5 profile.

Setup: built the add-on image from this branch (add-ons/common/Dockerfile + yarn build/yarn workspace @ps5-mqtt/server package), supplied the profile passcode via the LOGIN_PASSCODE env, restarted the add-on (existing pairing/credentials preserved).

Result:

• wake → console reached AWAKE cleanly.
• standby → console reached STANDBY cleanly (this is the command that previously failed intermittently with Error[1] PASSCODE_IS_NEEDED).
• PASSCODE_IS_NEEDED occurrences after the change: 0, no registration/auth errors.

The buildPassCodeArg() fragment is correctly appended to both the playactor wake and playactor standby invocations, and the numeric passcode is accepted. LGTM from a functional standpoint — thanks for the util + tests.

[andrew-codes]

I'll review this later today hopefully. Thanks for the contribution!

[andrew-codes]

This looks good. Thank you for the contribution! I'll follow up with some of the tests to the sagas. I don't think it is a blocker to the benefit of having the feature enabled for users.