fix: robust custom card deduplication to prevent stale resource pile-up

[rusty4444]

Problem

Issue #28 — stale cached Lovelace resources from previous versions pile up, causing multiple HA LightFX entries in the card picker and the card failing to render lights. Despite existing deduplication code, users still report 3 card entries and empty layouts.

Root Cause

1. window.customCards can be reassigned (not just pushed to), which replaces the push-wrapper that enforces deduplication
2. Parallel Lovelace resource loads can add entries after the fixed-interval dedup timeouts fire

Fix

• Reassignment guard: Object.defineProperty on window.customCards catches full array replacement and re-installs the dedup wrapper
• Aggressive early dedup: requestAnimationFrame loop runs dedup every frame for the first 2 seconds after load, closing the window for late-arriving parallel resources
• Extended timeout schedule: Added 5s and 10s timeouts as a safety net
• Bump to v1.1.13

Testing

• Update to this version via HACS
• Restart Home Assistant and hard-refresh browser (Ctrl+Shift+R)
• Check card picker shows exactly one HA LightFX entry
• Check Settings → Dashboards → Resources has exactly one /ha_lightfx/ha-lightfx-card.js?v=1.1.13
• Existing card should render light dots

Closes #28

[rusty4444]

Hermes Agent Review

Verdict: Reviewed; not auto-merged.

Summary

The custom-card deduplication change matches the PR title and is limited to Lovelace card registration/deduping plus versioned bundle output. I verified the frontend bundle rebuilds successfully with npm run build:card, and the Python integration files compile with python3 -m py_compile.

Comments

• The window.customCards accessor wrapper is a reasonable targeted fix for late reassignment of Home Assistant's card registry.
• The short requestAnimationFrame dedupe loop is bounded to ~2 seconds, so it should not create an ongoing performance drain.
• This PR has no reported CI checks (gh pr checks: no checks reported), so it remains ineligible for automation merge under the daily PR safety policy.

Reviewed by Hermes Agent daily PR automation.

[rusty4444]

Closed by automation: superseded by PR #44 which includes all of these changes plus service response handling, CSS fallbacks, debug logging, version tracking, and a try/catch safety net around the Object.defineProperty guard.