Merge remote-tracking branch 'origin/master' into dev

Brings the go2rtc security fixes from #24658 to dev. Dev-specific changes
in the merge:
- frigate/config/env.py stays deleted; the environment_vars protection for
  GO2RTC_ALLOW_ARBITRARY_EXEC moves to apply_config_env_vars in
  frigate/util/env.py, so the value never reaches os.environ
- services.py imports substitute_frigate_vars from frigate.util.env and
  maps UnknownVariableError to the unknown variable message
- go2rtc stream tests patch dev's import-time exec override snapshot and
  its FRIGATE_* variable sources
- test_http_media.py keeps dev's _insert_recording helper; the one added
  on master replaced it and broke the dev tests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frigate/data_processing/post/object_descriptions.py

@@ -105,6 +105,10 @@ class ObjectDescriptionProcessor(PostProcessorApi):
                         logger.debug(f"{camera} sending early request to GenAI")
 
                         self.early_request_sent[data["id"]] = True
+
+                        if camera_config.objects.genai.debug_save_thumbnails:
+                            self._save_debug_thumbnails(data["id"])
+
                         # Copy thumbnails to avoid holding references after cleanup
                         thumbnails_copy = [
                             data["thumbnail"][:] if data.get("thumbnail") else None
@@ -302,26 +306,7 @@ class ObjectDescriptionProcessor(PostProcessorApi):
         )
 
         if camera_config.objects.genai.debug_save_thumbnails and num_thumbnails > 0:
-            logger.debug(f"Saving {num_thumbnails} thumbnails for event {event_id}")
-
-            Path(os.path.join(CLIPS_DIR, f"genai-requests/{event_id}")).mkdir(
-                parents=True, exist_ok=True
-            )
-
-            for idx, data in enumerate(self.tracked_events[event_id], 1):
-                jpg_bytes: bytes | None = data["thumbnail"]
-
-                if jpg_bytes is None:
-                    logger.warning(f"Unable to save thumbnail {idx} for {event_id}.")
-                else:
-                    with open(
-                        os.path.join(
-                            CLIPS_DIR,
-                            f"genai-requests/{event_id}/{idx}.jpg",
-                        ),
-                        "wb",
-                    ) as j:
-                        j.write(jpg_bytes)
+            self._save_debug_thumbnails(event_id)
 
         # Generate the description. Call happens in a thread since it is network bound.
         threading.Thread(
@@ -337,6 +322,30 @@ class ObjectDescriptionProcessor(PostProcessorApi):
         # Clean up tracked events and early request state
         self.cleanup_event(event_id)
 
+    def _save_debug_thumbnails(self, event_id: str) -> None:
+        """Write the tracked thumbnails for an event to the genai-requests dir."""
+        tracked = self.tracked_events.get(event_id, [])
+        logger.debug(f"Saving {len(tracked)} thumbnails for event {event_id}")
+
+        Path(os.path.join(CLIPS_DIR, f"genai-requests/{event_id}")).mkdir(
+            parents=True, exist_ok=True
+        )
+
+        for idx, data in enumerate(tracked, 1):
+            jpg_bytes: bytes | None = data["thumbnail"]
+
+            if jpg_bytes is None:
+                logger.warning(f"Unable to save thumbnail {idx} for {event_id}.")
+            else:
+                with open(
+                    os.path.join(
+                        CLIPS_DIR,
+                        f"genai-requests/{event_id}/{idx}.jpg",
+                    ),
+                    "wb",
+                ) as j:
+                    j.write(jpg_bytes)
+
     def _genai_embed_description(self, event: Event, thumbnails: list[bytes]) -> None:
         """Embed the description for an event."""
         start = datetime.datetime.now().timestamp()