Fix code-review findings across domain, persistence, server and frontend

Full-codebase review turned up five real correctness/security bugs and
a dozen smaller inconsistencies; all are fixed here with matching test
coverage:

- BMK uniqueness silently allowed German-umlaut duplicates ("Ä1" vs
  "ä1") because the DB's normalized index only folds ASCII case. Added
  a shared Unicode-aware pre-check used by every circuit/component
  insert and rename path (one of which had no pre-check at all).
- CircuitDeviceRow.simultaneityFactor had no upper bound at the row
  level (command model and snapshot/restore schema), unlike every
  sibling entity, letting a bad value silently corrupt power totals.
- Grid cell editing silently misread German thousands-separator input
  ("1.500" parsed as 1.5); "." is now rejected outright with a clear
  message instead of guessing.
- The editor's shared command runner (runCommand/applyHistory) had no
  re-entrancy guard, so a double click/drop could fire the same
  command twice and race a BMK collision or revision conflict. Added a
  synchronous ref guard plus isSaving on the buttons that lacked it.
- GET .../next-identifier leaked circuit-numbering state for sections
  in other projects (no ownership check, 400 instead of 404). Moved
  under /projects/:projectId and scoped it.

Also: added the missing circuits.section_id / circuit_device_rows.
circuit_id indexes (migration 0006), gave FormModal a focus trap /
Escape-to-close / focus restore and rebuilt ProjectSettingsModal on
top of it instead of duplicated markup, removed dead code (3 orphaned
domain model files, an unused persistence helper, a wrapper only used
by its own test), pointed the project page at GET /projects/:id
instead of listing+filtering client-side, closed the gap between the
documented 18 MB CSV limit and the ~17.17 MiB actually enforced, added
missing upper bounds on several free-text fields, filled in nine
missing German labels in the revision timeline, replaced a
key-order-fragile JSON.stringify equality check with a real field
comparison, made an implicit sort-order assumption in three
renumbering helpers explicit, cleared the sidebar's target selection
when it no longer resolves after a tree reload, and fixed
updateGlobalDevice to check-then-write instead of write-then-check.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/server/controllers/circuit.controller.ts

@@ -1,10 +1,21 @@
 import type { Request, Response } from "express";
 import { circuitNumberingService } from "../composition/circuit-numbering-service.js";
+import {
+  circuitListRepository,
+  circuitSectionRepository,
+} from "../composition/application-repositories.js";
 
 export async function getNextCircuitIdentifier(req: Request, res: Response) {
-  const { sectionId } = req.params;
-  if (typeof sectionId !== "string") {
-    return res.status(400).json({ error: "Invalid sectionId" });
+  const { projectId, sectionId } = req.params;
+  if (typeof projectId !== "string" || typeof sectionId !== "string") {
+    return res.status(400).json({ error: "Invalid parameters" });
+  }
+  const section = await circuitSectionRepository.findById(sectionId);
+  const list = section
+    ? await circuitListRepository.findById(projectId, section.circuitListId)
+    : null;
+  if (!section || !list) {
+    return res.status(404).json({ error: "Section not found" });
   }
   try {
     const nextIdentifier =

src/server/controllers/global-device.controller.ts

@@ -34,11 +34,12 @@ export async function updateGlobalDevice(req: Request, res: Response) {
     return res.status(400).json({ error: parsed.error.flatten() });
   }
 
-  await globalDeviceRepository.update(globalDeviceId, parsed.data);
-  const row = await globalDeviceRepository.findById(globalDeviceId);
-  if (!row) {
+  const existing = await globalDeviceRepository.findById(globalDeviceId);
+  if (!existing) {
     return res.status(404).json({ error: "Global device not found" });
   }
+  await globalDeviceRepository.update(globalDeviceId, parsed.data);
+  const row = await globalDeviceRepository.findById(globalDeviceId);
   return res.json(row);
 }
 

src/server/index.ts

@@ -1,5 +1,4 @@
 import express from "express";
-import { circuitRouter } from "./routes/circuit.routes.js";
 import { globalDeviceRouter } from "./routes/global-device.routes.js";
 import { projectDeviceRouter } from "./routes/project-device.routes.js";
 import { projectRouter } from "./routes/project.routes.js";
@@ -48,7 +47,6 @@ app.get("/health", (_req, res) => {
 });
 
 app.use("/api/projects", projectRouter);
-app.use("/api", circuitRouter);
 app.use("/api/global-devices", globalDeviceRouter);
 app.use("/api/project-devices", projectDeviceRouter);
 

src/server/routes/circuit.routes.ts

@@ -1,9 +0,0 @@
-import { Router } from "express";
-import {
-  getNextCircuitIdentifier,
-} from "../controllers/circuit.controller.js";
-
-export const circuitRouter = Router();
-
-circuitRouter.get("/circuit-sections/:sectionId/next-identifier", getNextCircuitIdentifier);
-

src/server/routes/project.routes.ts

@@ -16,6 +16,7 @@ import { listCircuitListsByProject } from "../controllers/circuit-list.controlle
 import { createFloor, deleteFloor, listFloorsByProject, updateFloor } from "../controllers/floor.controller.js";
 import { createRoom, deleteRoom, listRoomsByProject, updateRoom } from "../controllers/room.controller.js";
 import { getCircuitTree } from "../controllers/circuit-tree.controller.js";
+import { getNextCircuitIdentifier } from "../controllers/circuit.controller.js";
 import {
   getProjectHistory,
   listProjectRevisions,
@@ -95,6 +96,10 @@ projectRouter.delete(
 );
 projectRouter.get("/:projectId/circuit-lists", listCircuitListsByProject);
 projectRouter.get("/:projectId/circuit-lists/:circuitListId/tree", getCircuitTree);
+projectRouter.get(
+  "/:projectId/circuit-sections/:sectionId/next-identifier",
+  getNextCircuitIdentifier
+);
 projectRouter.get("/:projectId/floors", listFloorsByProject);
 projectRouter.post("/:projectId/floors", createFloor);
 projectRouter.put("/:projectId/floors/:floorId", updateFloor);