fix: guard against 0 / unfriendly font-scale editing (#49)

[szrudi]

Closes #49.

Problem

Seen live during a labelling session on hector. Two halves of the same bug:

1. Server crash. /api/preview (and the print path) 500'd with ValueError: font size must be greater than 0. labelle sizes the font as round(line_height * fontScale/100) and PIL's ImageFont.truetype rejects a size of 0, so a fontScale of 0 took down the whole render.

2. The input produced that 0, and was miserable to edit. The Scale field was a plain <input type="number" value={number}>. Backspacing the 90 default left the field empty, and Number("") === 0 got committed — i.e. the UI manufactured the exact value that crashes the server. Worse, the leftover digit meant typing a replacement read as a leading-zero (60 → 06). (Reported verbatim: cleared 90, got 0, tried to type 60, ended up with 06.)

Fix

Server (label_builder.py): add _font_size_ratio() — coerces fontScale to a positive ratio and falls back to the default (DEFAULT_FONT_SCALE = 90, matching the client) for any non-positive or non-numeric value. Defends preview and print against malformed label files / direct API calls, not just this one input.

Client: extract NumberField, a numeric input that keeps the visible text as a free-form draft so the field can be emptied and retyped, commits a clamped number to the store only when the draft parses, and resyncs the draft to the committed value on blur — never mid-type, so clamping can't snap a half-entered number out from under the cursor. Reused for both the Scale and Frame inputs in TextWidgetEditor.

Tests

• Server: TestFontScaleGuard — zero/negative/non-numeric/missing fall back to default; valid values pass through; preview_label with fontScale: 0 returns valid PNG bytes instead of raising.
• Client: NumberField.test.tsx — clearing shows empty (not 0) and commits nothing; clear-and-retype has no leading zero; clamps below min / above max; settles to the clamped value on blur; reflects external value changes when not being edited.
• Full suites green: client 87 passed, server 297 passed.

Version

PATCH bump 1.8.2 → 1.8.3.

🤖 Generated with Claude Code

[szrudi]

Tacked on one small unrelated UI tweak (af0b631): widened the gap between a batch row's preview (eye) and delete (x) buttons from gap-2 → gap-4. They were close enough that previewing a row risked deleting it by accident. No version re-bump — folds into the unreleased 1.8.3.

[szrudi]

Release batching (read before merging): dropped this PR's version bump (back to 1.8.2 = current main, commit 12bf760) so merging it alone triggers no release. Its fixes ship together with #52 under a single 1.8.3 release.

➡️ Merge this PR first, then #52. #52 carries the only version bump (1.8.3); because its merge commit sits on top of this one, the single release build contains both PRs' changes — avoiding two back-to-back releases.

[szrudi]

Self-review follow-up (9162d40): an independent adversarial pass caught that NaN/Infinity slip past the <= 0 guard — Flask's JSON parser accepts the NaN/Infinity literals, so {"fontScale": NaN} reproduced the same 500. Fixed with math.isfinite + tests. Also documented a residual: a tiny positive fontScale (e.g. 1) can round to 0 px on a small tape and still raise — unreachable from the UI (min 10), tape-dependent, so left un-normalized rather than silently clamping otherwise-valid values.

[szrudi]

Final release plan (supersedes my earlier comment): no version bump here; merge it before #52. Full order is #53 → #51 → #52, where only #52 bumps (1.8.3) and triggers the single release containing all three.