Harden Pi-hole auth handling and Google OAuth configuration

[aSbiEL0]

Summary

• require an explicit scheme for remote Pi-hole hosts and validate TLS/timeout-related configuration
• improve Pi-hole auth handling in piholestats_v1.1.py, including v6-session vs legacy-token mode detection and clearer auth/transport failure reporting
• tighten Google Calendar and Photos OAuth handling around loopback redirects, Desktop OAuth clients, and token scope parsing
• add a Photos --auth-only mode and improve token-path separation from the calendar flow
• update .env.example and README.md to document the revised Pi-hole and Google OAuth setup

Testing

• not run from this Codex environment

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[aSbiEL0]

@codex[agent] please address the merge conflicts

[Codex]

@aSbiEL0 I've opened a new pull request, #85, to work on those changes. Once the pull request is ready, I'll request review from you.

[chatgpt-codex-connector]

Summary

• Resolved the merge-conflict surface by reconciling all overlapping files from the original PR against the current base state, including .env.example, README.md, and the four affected scripts (calendash-api.py, photos-shuffle.py, piholestats_v1.1.py, piholestats_v1.2.py). .env.exampleL1-L72 README.mdL86-L141 scripts/calendash-api.pyL1-L45 scripts/photos-shuffle.pyL1-L40 scripts/piholestats_v1.1.pyL1-L40 scripts/piholestats_v1.2.pyL1-L40
• The resolved calendash-api.py keeps the newer auth-diagnostics and OAuth failure-guidance flow (including redirect mismatch handling and persisted diagnostics), which was part of the conflict-heavy area with upstream updates. scripts/calendash-api.pyL103-L127 scripts/calendash-api.pyL366-L393 scripts/calendash-api.pyL500-L574
• The resolved photos-shuffle.py retains the updated OAuth flow behavior and CLI controls (including --auth-only), and piholestats_v1.2.py keeps explicit auth/transport failure classification used in status handling. scripts/photos-shuffle.pyL22-L40 scripts/photos-shuffle.pyL520-L561 scripts/piholestats_v1.2.pyL375-L409 scripts/piholestats_v1.2.pyL529-L555

Testing

• ⚠️ curl -I -s https://git-scm.com/docs/git-merge | head -n 5 (site responded 403 in this environment)
• ✅ rg -n "^(<<<<<<<|=======|>>>>>>>)" . || true
• ✅ python -m py_compile scripts/calendash-api.py scripts/photos-shuffle.py scripts/piholestats_v1.1.py scripts/piholestats_v1.2.py

Committed on branch work as:

• 316f3b1 — Resolve merge conflicts with latest base branch

I also created a follow-up PR via the make_pr tool with a conflict-resolution title/body on top of the original PR.

View task →