Vendor HTMX/Pico/Chart.js so HTMX buttons work in pywebview

HTMX, Pico CSS, Chart.js and chartjs-adapter-date-fns all loaded from
cdn.jsdelivr.net with an SRI hash on the HTMX script. Inside pywebview
(WKWebView on macOS) the HTMX request was failing — offline-tolerant
caching, an SRI mismatch on a re-built CDN file, or strict
content-policy — and dropping silently. Without HTMX every HTMX button
(Test MongoDB connection, Test SolisCloud, Poll SolisCloud now) clicked
to nothing with no console error, which presented as "I can't click on
anything in the app".

Everything is now served from `src/solisdash/static/vendor/`:
  - pico.min.css        (Pico 2)
  - htmx.min.js         (HTMX 2.0.4)
  - chart.umd.min.js    (Chart.js 4.4.7)
  - chartjs-adapter-date-fns.bundle.min.js

base.html and history.html load them via `url_for('static', path='vendor/…')`.
No network roundtrip on first render, no CDN dependency at runtime.

Also adds `tests/test_clickability.py`:
  - For every authed page, extract every `<a href>`, `<form action>`
    and `[hx-{get,post,put,delete}]` URL pointing back at our app, then
    assert the endpoint doesn't 5xx (catches "I shipped a button whose
    handler doesn't exist" and "the handler 500s on empty input").
  - Refuse any future `cdn.jsdelivr.net` / `unpkg.com` /
    `cdnjs.cloudflare.com` reference in a template.
  - Confirm all four vendored asset files are present on disk.
  - Refuse `pointer-events` declarations in style.css without an
    explicit `/* allow-pointer-events: … */` justification.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jdrumgoole

CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to **Solisdash** are documented here. Version numbers
 follow [Semantic Versioning](https://semver.org/). The package is published
 to PyPI on every `vX.Y.Z` tag push.
 
+## 0.8.1 — 2026-05-16
+
+### Fixed
+- **HTMX buttons (Test MongoDB connection, Test SolisCloud, Poll
+  SolisCloud now) silently did nothing inside pywebview.** HTMX was
+  loaded from a CDN with SRI; pywebview's WKWebView dropped the script
+  in some environments (offline, strict caching, SRI mismatches) and
+  the buttons stopped working with no visible error. Solisdash now
+  vendors HTMX, Pico CSS, Chart.js, and the Chart.js date-fns adapter
+  under `static/vendor/`, so the entire UI works without network access
+  to a CDN.
+
+### Added
+- `tests/test_clickability.py` regression suite. For every authed
+  page (`/`, `/history`, `/alarms`, `/settings`) we extract every
+  `<a href>`, `<form action>`, `[hx-{get,post,put,delete}]` URL
+  pointing at our own app and assert each endpoint doesn't 5xx. The
+  same file also asserts (a) no template references a CDN at runtime,
+  (b) all four vendored assets are present on disk, and (c) `style.css`
+  doesn't sneak in a `pointer-events: none` overlay.
+
 ## 0.8.0 — 2026-05-16
 
 ### Added

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "solisdash"
-version = "0.8.0"
+version = "0.8.1"
 description = "Self-hosted dashboard for the SolisCloud (Ginlong Solis) platform"
 readme = "README.md"
 requires-python = ">=3.10"

src/solisdash/__init__.py

@@ -1 +1 @@
-__version__ = "0.8.0"
+__version__ = "0.8.1"

src/solisdash/static/vendor/chart.umd.min.js

@@ -4,10 +4,7 @@
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <title>{% block title %}Solisdash{% endblock %}</title>
-  <link
-    rel="stylesheet"
-    href="https://cdn.jsdelivr.net/npm/@picocss/pico@2/css/pico.min.css"
-  />
+  <link rel="stylesheet" href="{{ url_for('static', path='vendor/pico.min.css') }}" />
   <link rel="stylesheet" href="{{ url_for('static', path='style.css') }}" />
   <script>
     // Apply persisted theme as early as possible to avoid a flash on load.
@@ -20,12 +17,7 @@
       }
     })();
   </script>
-  <script
-    src="https://cdn.jsdelivr.net/npm/htmx.org@2.0.4/dist/htmx.min.js"
-    integrity="sha384-HGfztofotfshcF7+8n44JQL2oJmowVChPTg48S+jvZoztPfvwD79OC/LTtG6dMp+"
-    crossorigin="anonymous"
-    defer
-  ></script>
+  <script src="{{ url_for('static', path='vendor/htmx.min.js') }}" defer></script>
 </head>
 <body>
   <header class="container">

src/solisdash/static/vendor/chartjs-adapter-date-fns.bundle.min.js

@@ -89,13 +89,7 @@ <h2>History</h2>
   </article>
 {% endif %}
 
-<script
-  src="https://cdn.jsdelivr.net/npm/chart.js@4.4.7/dist/chart.umd.min.js"
-  defer
-></script>
-<script
-  src="https://cdn.jsdelivr.net/npm/chartjs-adapter-date-fns@3/dist/chartjs-adapter-date-fns.bundle.min.js"
-  defer
-></script>
+<script src="{{ url_for('static', path='vendor/chart.umd.min.js') }}" defer></script>
+<script src="{{ url_for('static', path='vendor/chartjs-adapter-date-fns.bundle.min.js') }}" defer></script>
 <script src="{{ url_for('static', path='history.js') }}" defer></script>
 {% endblock %}

src/solisdash/static/vendor/htmx.min.js

@@ -75,8 +75,10 @@ async def test_history_page_renders_station_picker_and_chart_canvas(
     assert 'id="station-select"' in body
     assert "Roof" in body
     assert 'id="history-chart"' in body
-    assert "chart.js" in body
+    assert "chart.umd.min.js" in body
     assert "chartjs-adapter-date-fns" in body
+    # Must be vendored under /static/vendor/ (see test_clickability.py).
+    assert "cdn.jsdelivr.net" not in body
 
 
 async def test_history_page_renders_metric_tabs(