Fix code-review findings across domain, persistence, server and frontend

Full-codebase review turned up five real correctness/security bugs and
a dozen smaller inconsistencies; all are fixed here with matching test
coverage:

- BMK uniqueness silently allowed German-umlaut duplicates ("Ä1" vs
  "ä1") because the DB's normalized index only folds ASCII case. Added
  a shared Unicode-aware pre-check used by every circuit/component
  insert and rename path (one of which had no pre-check at all).
- CircuitDeviceRow.simultaneityFactor had no upper bound at the row
  level (command model and snapshot/restore schema), unlike every
  sibling entity, letting a bad value silently corrupt power totals.
- Grid cell editing silently misread German thousands-separator input
  ("1.500" parsed as 1.5); "." is now rejected outright with a clear
  message instead of guessing.
- The editor's shared command runner (runCommand/applyHistory) had no
  re-entrancy guard, so a double click/drop could fire the same
  command twice and race a BMK collision or revision conflict. Added a
  synchronous ref guard plus isSaving on the buttons that lacked it.
- GET .../next-identifier leaked circuit-numbering state for sections
  in other projects (no ownership check, 400 instead of 404). Moved
  under /projects/:projectId and scoped it.

Also: added the missing circuits.section_id / circuit_device_rows.
circuit_id indexes (migration 0006), gave FormModal a focus trap /
Escape-to-close / focus restore and rebuilt ProjectSettingsModal on
top of it instead of duplicated markup, removed dead code (3 orphaned
domain model files, an unused persistence helper, a wrapper only used
by its own test), pointed the project page at GET /projects/:id
instead of listing+filtering client-side, closed the gap between the
documented 18 MB CSV limit and the ~17.17 MiB actually enforced, added
missing upper bounds on several free-text fields, filled in nine
missing German labels in the revision timeline, replaced a
key-order-fragile JSON.stringify equality check with a real field
comparison, made an implicit sort-order assumption in three
renumbering helpers explicit, cleared the sidebar's target selection
when it no longer resolves after a tree reload, and fixed
updateGlobalDevice to check-then-write instead of write-then-check.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/db/schema/circuit-device-rows.ts

@@ -1,35 +1,38 @@
-import { integer, real, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { index, integer, real, sqliteTable, text } from "drizzle-orm/sqlite-core";
 import { circuits } from "./circuits.js";
 import { projectDevices } from "./project-devices.js";
 import { rooms } from "./rooms.js";
 
-export const circuitDeviceRows = sqliteTable("circuit_device_rows", {
-  id: text("id").primaryKey(),
-  circuitId: text("circuit_id")
-    .notNull()
-    .references(() => circuits.id, { onDelete: "cascade" }),
-  linkedProjectDeviceId: text("linked_project_device_id").references(() => projectDevices.id, {
-    onDelete: "set null",
-  }),
-  sortOrder: integer("sort_order").notNull().default(0),
-  name: text("name").notNull(),
-  displayName: text("display_name").notNull(),
-  phaseType: text("phase_type"),
-  connectionKind: text("connection_kind"),
-  costGroup: text("cost_group"),
-  category: text("category"),
-  level: text("level"),
-  roomId: text("room_id").references(() => rooms.id, {
-    onDelete: "set null",
-  }),
-  roomNumberSnapshot: text("room_number_snapshot"),
-  roomNameSnapshot: text("room_name_snapshot"),
-  quantity: integer("quantity").notNull(),
-  manualQuantity: integer("manual_quantity").notNull().default(0),
-  powerPerUnit: real("power_per_unit").notNull(),
-  simultaneityFactor: real("simultaneity_factor").notNull(),
-  cosPhi: real("cos_phi"),
-  remark: text("remark"),
-  overriddenFields: text("overridden_fields"),
-});
-
+export const circuitDeviceRows = sqliteTable(
+  "circuit_device_rows",
+  {
+    id: text("id").primaryKey(),
+    circuitId: text("circuit_id")
+      .notNull()
+      .references(() => circuits.id, { onDelete: "cascade" }),
+    linkedProjectDeviceId: text("linked_project_device_id").references(() => projectDevices.id, {
+      onDelete: "set null",
+    }),
+    sortOrder: integer("sort_order").notNull().default(0),
+    name: text("name").notNull(),
+    displayName: text("display_name").notNull(),
+    phaseType: text("phase_type"),
+    connectionKind: text("connection_kind"),
+    costGroup: text("cost_group"),
+    category: text("category"),
+    level: text("level"),
+    roomId: text("room_id").references(() => rooms.id, {
+      onDelete: "set null",
+    }),
+    roomNumberSnapshot: text("room_number_snapshot"),
+    roomNameSnapshot: text("room_name_snapshot"),
+    quantity: integer("quantity").notNull(),
+    manualQuantity: integer("manual_quantity").notNull().default(0),
+    powerPerUnit: real("power_per_unit").notNull(),
+    simultaneityFactor: real("simultaneity_factor").notNull(),
+    cosPhi: real("cos_phi"),
+    remark: text("remark"),
+    overriddenFields: text("overridden_fields"),
+  },
+  (table) => [index("circuit_device_rows_circuit_id_idx").on(table.circuitId)]
+);

src/db/schema/circuits.ts

@@ -1,4 +1,4 @@
-import { integer, real, sqliteTable, text, unique } from "drizzle-orm/sqlite-core";
+import { index, integer, real, sqliteTable, text, unique } from "drizzle-orm/sqlite-core";
 import { circuitLists } from "./circuit-lists.js";
 import { circuitSections } from "./circuit-sections.js";
 
@@ -26,6 +26,9 @@ export const circuits = sqliteTable(
     isReserve: integer("is_reserve").notNull().default(0),
     remark: text("remark"),
   },
-  (table) => [unique("circuits_list_equipment_identifier_unique").on(table.circuitListId, table.equipmentIdentifier)]
+  (table) => [
+    unique("circuits_list_equipment_identifier_unique").on(table.circuitListId, table.equipmentIdentifier),
+    index("circuits_section_id_idx").on(table.sectionId),
+  ]
 );