Fix code-review findings across domain, persistence, server and frontend

Full-codebase review turned up five real correctness/security bugs and
a dozen smaller inconsistencies; all are fixed here with matching test
coverage:

- BMK uniqueness silently allowed German-umlaut duplicates ("Ä1" vs
  "ä1") because the DB's normalized index only folds ASCII case. Added
  a shared Unicode-aware pre-check used by every circuit/component
  insert and rename path (one of which had no pre-check at all).
- CircuitDeviceRow.simultaneityFactor had no upper bound at the row
  level (command model and snapshot/restore schema), unlike every
  sibling entity, letting a bad value silently corrupt power totals.
- Grid cell editing silently misread German thousands-separator input
  ("1.500" parsed as 1.5); "." is now rejected outright with a clear
  message instead of guessing.
- The editor's shared command runner (runCommand/applyHistory) had no
  re-entrancy guard, so a double click/drop could fire the same
  command twice and race a BMK collision or revision conflict. Added a
  synchronous ref guard plus isSaving on the buttons that lacked it.
- GET .../next-identifier leaked circuit-numbering state for sections
  in other projects (no ownership check, 400 instead of 404). Moved
  under /projects/:projectId and scoped it.

Also: added the missing circuits.section_id / circuit_device_rows.
circuit_id indexes (migration 0006), gave FormModal a focus trap /
Escape-to-close / focus restore and rebuilt ProjectSettingsModal on
top of it instead of duplicated markup, removed dead code (3 orphaned
domain model files, an unused persistence helper, a wrapper only used
by its own test), pointed the project page at GET /projects/:id
instead of listing+filtering client-side, closed the gap between the
documented 18 MB CSV limit and the ~17.17 MiB actually enforced, added
missing upper bounds on several free-text fields, filled in nine
missing German labels in the revision timeline, replaced a
key-order-fragile JSON.stringify equality check with a real field
comparison, made an implicit sort-order assumption in three
renumbering helpers explicit, cleared the sidebar's target selection
when it no longer resolves after a tree reload, and fixed
updateGlobalDevice to check-then-write instead of write-then-check.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/shared/validation/external-csv.schemas.ts

@@ -1,5 +1,10 @@
 import { z } from "zod";
 
+// Base64 length of the 18 MiB transport limit documented for CSV uploads
+// (18 * 1024 * 1024 bytes, evenly divisible by 3, so ceil(N/3)*4 with no
+// padding). Keep in sync with the controller's raw byte-length check.
+export const MAX_CSV_CONTENT_BASE64_LENGTH = 25_165_824;
+
 export const updateExternalCsvConfigurationSchema = z
   .object({
     expectedRevision: z.number().int().nonnegative(),
@@ -10,7 +15,7 @@ export const updateExternalCsvConfigurationSchema = z
 export const previewExternalCsvSchema = z
   .object({
     fileName: z.string().trim().min(1).max(255),
-    contentBase64: z.string().min(1).max(24_000_000),
+    contentBase64: z.string().min(1).max(MAX_CSV_CONTENT_BASE64_LENGTH),
   })
   .strict();
 
@@ -21,7 +26,7 @@ export const applyExternalInitialImportSchema = z.object({
   expectedConfigurationVersion: z.number().int().positive(),
   expectedSha256: z.string().regex(/^[a-f0-9]{64}$/),
   fileName: z.string().trim().min(1).max(255),
-  contentBase64: z.string().min(1).max(24_000_000),
+  contentBase64: z.string().min(1).max(MAX_CSV_CONTENT_BASE64_LENGTH),
   sourceName: z.string().trim().min(1).max(200),
   roomDecisions: z.array(z.object({
     sourceRoomKey: z.string().trim().min(1),

src/shared/validation/global-device.schemas.ts

@@ -1,15 +1,15 @@
 import { z } from "zod";
 
 export const createGlobalDeviceSchema = z.object({
-  name: z.string().min(1),
-  displayName: z.string().min(1),
-  category: z.string().optional(),
+  name: z.string().min(1).max(200),
+  displayName: z.string().min(1).max(200),
+  category: z.string().max(100).optional(),
   quantity: z.number().min(0),
   installedPowerPerUnitKw: z.number().min(0),
   demandFactor: z.number().min(0).max(1),
   phaseCount: z.union([z.literal(1), z.literal(3)]),
   powerFactor: z.number().min(0).max(1).optional(),
-  note: z.string().optional(),
+  note: z.string().max(2000).optional(),
 }).strict();
 
 export const updateGlobalDeviceSchema = createGlobalDeviceSchema;

src/shared/validation/project-device.schemas.ts

@@ -4,16 +4,16 @@ import { expectedProjectRevisionSchema } from "./project-command.schemas.js";
 import { circuitGroupCategories } from "../constants/circuit-group.js";
 
 export const createProjectDeviceSchema = z.object({
-  name: z.string().min(1),
-  displayName: z.string().min(1),
-  connectionKind: z.string().optional(),
-  costGroup: z.string().optional(),
+  name: z.string().min(1).max(200),
+  displayName: z.string().min(1).max(200),
+  connectionKind: z.string().max(100).optional(),
+  costGroup: z.string().max(100).optional(),
   category: z.enum(circuitGroupCategories),
   quantity: z.number().min(0),
   powerPerUnit: z.number().min(0),
   simultaneityFactor: z.number().min(0).max(1),
   cosPhi: z.number().min(0).max(1).optional(),
-  remark: z.string().optional(),
+  remark: z.string().max(2000).optional(),
 }).strict();
 
 export const updateProjectDeviceSchema = createProjectDeviceSchema;

src/shared/validation/project-structure.schemas.ts

@@ -36,7 +36,7 @@ export const updateProjectSettingsSchema = z
 export const createDistributionBoardSchema = z
   .object({
     expectedRevision: expectedProjectRevisionSchema,
-    name: z.string().trim().min(1),
+    name: z.string().trim().min(1).max(200),
     floorId: z.string().trim().min(1).nullable(),
     supplyType: z.enum(distributionBoardSupplyTypes),
   })
@@ -67,7 +67,7 @@ export const deleteDistributionBoardSchema = z
 export const createFloorSchema = z
   .object({
     expectedRevision: expectedProjectRevisionSchema,
-    name: z.string().trim().min(1),
+    name: z.string().trim().min(1).max(200),
   })
   .strict();
 
@@ -83,8 +83,8 @@ export const createRoomSchema = z
   .object({
     expectedRevision: expectedProjectRevisionSchema,
     floorId: z.string().trim().min(1).optional(),
-    roomNumber: z.string().trim().min(1),
-    roomName: z.string().trim().min(1),
+    roomNumber: z.string().trim().min(1).max(50),
+    roomName: z.string().trim().min(1).max(200),
   })
   .strict();
 
@@ -92,8 +92,8 @@ export const updateRoomSchema = z
   .object({
     expectedRevision: expectedProjectRevisionSchema,
     floorId: z.string().trim().min(1).nullable(),
-    roomNumber: z.string().trim().min(1),
-    roomName: z.string().trim().min(1),
+    roomNumber: z.string().trim().min(1).max(50),
+    roomName: z.string().trim().min(1).max(200),
   })
   .strict();