Add "Mein Zimmer" room-control page (Home Assistant, proxied through the backend)

Implements the room-control page from the design mockup: a scenes row above cards
for shutters, color lamps, and brightness-only lamps, all driven by a new
`general.ha` config section (server URL, token, ordered device/scene lists).

The backend proxies every Home Assistant call server-side (GET/POST /api/ha/...)
rather than the browser calling Home Assistant directly, so the long-lived token
never leaves the LAN device and Home Assistant's own CORS settings don't need to
know about musicmouse at all. Card kind (shutter/color/brightness-only) is
inferred at runtime from what Home Assistant reports about each entity, not
configured explicitly.

Also stops tracking python-backend/config.yml, which had drifted into the repo
despite its own header saying it shouldn't be - it now carries real credentials
locally and needs to stay untracked.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

python-backend/pyproject.toml

@@ -6,6 +6,10 @@ requires-python = ">=3.13"
 dependencies = [
     "aiomqtt>=2.0",
     "fastapi>=0.115",
+    # Also what tests drive the ASGI app with - plain httpx is deprecated in favour of
+    # this for exactly that. Runtime uses it to proxy the room page's Home Assistant
+    # calls, so the long-lived token never has to leave the backend.
+    "httpx2>=2.12",
     "mutagen>=1.47",
     "pillow>=10.4",
     "pydantic>=2.7",
@@ -19,8 +23,7 @@ dependencies = [
 ]
 
 [project.optional-dependencies]
-# httpx2 is what starlette.testclient wants now; plain httpx is deprecated there.
-dev = ["httpx2>=2.12", "mypy>=1.10", "pytest-asyncio>=0.23", "pytest>=8.0", "ruff>=0.5"]
+dev = ["mypy>=1.10", "pytest-asyncio>=0.23", "pytest>=8.0", "ruff>=0.5"]
 
 [project.scripts]
 musicmouse = "musicmouse.__main__:main"