HA: value-setting controls (dimming, cover position, thermostat setpoint, fan speed)

[badbread]

Audit gap (capability ceiling; epic #52 P4). Control is on/off/press only. No brightness, cover set_position, climate setpoint, fan percentage, color, media. Large: new request shape (action+value), per-service param whitelist, HA body construction, validation, client controls (sliders). The biggest thing between 'light switch' and a real control surface. Part of the HA management overhaul epic.

[badbread]

Slice 1 (percent-kind value controls: light brightness, cover position, fan speed) is complete and merged to main.

• Backend + contract: feat(ha): value-setting HA controls (brightness/position/speed), #442 Slice 1 #460 — new action words set_brightness/set_position/set_speed carrying an optional numeric value, validated 0–100 server-side before HA is contacted; the action allowlist is now a structured spec table; a kind-agnostic control descriptor on GET /ha/states is the client capability signal (absent ⇒ no slider). No migration.
• Clients (kind-agnostic sliders, commit-on-release, one call per gesture): desktop feat(desktop): HA value-setting slider for #442 Slice 1 #461, iOS/macOS feat(ios): value slider for HA percent controls (#442 Slice 1) #462, Android feat(android): HA value slider for brightness/position/speed (#442 Slice 1) #463.
• allowed_actions = null includes the new value words; cover/require_confirm still confirm.

Remaining: Slice 2 — climate set_temperature (thermostat setpoint). It adds a new domain, entity-attribute-derived min/max/step, the HA unit, and joins the hardcoded-confirm set on all clients. The sliders are already kind-agnostic, so Slice 2 reuses them. Tracking here until Slice 2 lands.