fix: tolerante GUI-Filter, sichtbare Bedienelemente, fixierte Navigation

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

finance/tests/test_gui.py

@@ -78,6 +78,46 @@ def test_buchungen_pagination(client, db):
     assert "MARKER51" in r2.text
 
 
+def test_buchungen_empty_filter_fields_no_422(client):
+    # HTML-Formulare senden bei nicht ausgefüllten Feldern leere Strings, nicht
+    # "kein Parameter" — die GUI-Route muss das tolerant behandeln statt mit
+    # einem rohen 422 zu scheitern.
+    client.post("/login", data={"username": "admin", "password": "geheim"})
+    r = client.get(
+        "/buchungen"
+        "?account_id=2&date_from=&date_to=&category_id=&q=&status=confirmed"
+    )
+    assert r.status_code == 200
+
+
+def test_buchungen_filled_filters_scope_to_account(client, db):
+    from app.models.tables import Account, Transaction
+
+    acc_a = Account(bank="dkb", iban="DE01", name="Konto A", type="giro")
+    acc_b = Account(bank="dkb", iban="DE02", name="Konto B", type="giro")
+    db.add_all([acc_a, acc_b])
+    db.flush()
+    db.add(Transaction(
+        account_id=acc_a.id, booking_date=date(2026, 6, 15),
+        amount=Decimal("10.00"), purpose="MARKER-A", counterparty="X",
+        status="confirmed", dedup_hash="hash-a",
+    ))
+    db.add(Transaction(
+        account_id=acc_b.id, booking_date=date(2026, 6, 15),
+        amount=Decimal("20.00"), purpose="MARKER-B", counterparty="Y",
+        status="confirmed", dedup_hash="hash-b",
+    ))
+    db.commit()
+
+    client.post("/login", data={"username": "admin", "password": "geheim"})
+    r = client.get(
+        f"/buchungen?account_id={acc_a.id}&date_from=2026-06-01&date_to=2026-06-30"
+    )
+    assert r.status_code == 200
+    assert "MARKER-A" in r.text
+    assert "MARKER-B" not in r.text
+
+
 def test_planning_page_has_all_sections(client):
     client.post("/login", data={"username": "admin", "password": "geheim"})
     r = client.get("/planung")