One LED cannot say two things at once, and in the default presence
mode the status LED is already carrying "a card is here". The result
was that a bad read - a checksum failure - was reported not at all:
verified by driving the LED worker, which showed presence mode
producing no light on invalid_card while error mode blinked.
A second LED on its own pin (GPIO 24 = physical pin 18, matching the
workstation app) now pulses for --error-pulse seconds on a bad read,
leaving the status light to keep tracking the card. This also gives
ERROR_BLINK_SECONDS, previously dead, a real use.
--error-led-pin N / --error-led-active-low / --error-pulse S
--no-error-led restores the single-LED blink
install.sh rewrites the unit's ExecStart for all of it, verified for
the default, active-low and no-error-led cases.
Also extracts the repeated backend-opening code into _open_led(),
which keeps the BadPinFactory-is-an-ImportError subtlety in one place
instead of two, and treats the error pin colliding with the status
pin as "no error LED" rather than opening one pin twice.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ske087
a399542a6e