fix: Final-Review-Findings (GUI-Login, FK-Kaskaden, Validierung, Duplikat-Recheck, Views)

F1: GUI-Login-Hash gegen $-Korruption gehaertet. .env-Werte einfach-gequotet
    geschrieben + Sanity-Check nach Sourcing. Zusaetzlich systemd-Ebene:
    podman escapt $->$$ in Environment=, systemd 252 kollabiert das nicht ->
    sed-Post-Processing der Unit-Dateien. Live-.env: GUI-Passwort rotiert.
F2: Explizite Dependent-Deletes gegen FK-500 (delete_scenario/loan), 409 bei
    bestaetigtem Import-Delete. Test-Engine erzwingt PRAGMA foreign_keys=ON.
F3: Enum/Range-Validierung (Literal + Field ge/le) fuer Recurring, Loan,
    Modifier inkl. PATCH-Pfade.
F4: Confirm nur fuer draft-Statements (sonst 409) + Dedup-Re-Check gegen
    bestaetigte Buchungen vor dem Promoten.
F5: v_balance_history/v_balance_total addieren pro Konto den opening_balance
    des fruehesten bestaetigten Statements (approved deviation vom Plan-SQL).
F6: patch_scenario Namenskollision -> 409; create_transaction unbekanntes
    Konto -> 404 (statt 500).
F7: Generierte systemd-Unit-Dateien chmod 600 (enthalten Env-Secrets).
F8: Globaler htmx:responseError-Handler in base.html.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

finance/app/routers/planning.py

@@ -1,15 +1,17 @@
 from datetime import date
 from decimal import Decimal
+from typing import Literal
 
 from fastapi import APIRouter, Depends, HTTPException
-from pydantic import BaseModel, ConfigDict
-from sqlalchemy import select
+from pydantic import BaseModel, ConfigDict, Field
+from sqlalchemy import delete, select
 from sqlalchemy.orm import Session
 
 from app.auth import require_auth
 from app.db import get_session
 from app.engine.loans import loan_schedule
-from app.models.tables import Category, Loan, PlannedItem, RecurringItem
+from app.models.tables import (Category, Loan, PlannedItem, RecurringItem,
+                               ScenarioLoan)
 from app.services.suggestions import suggest_recurring
 
 router = APIRouter(prefix="/api", tags=["planning"],
@@ -20,8 +22,8 @@ router = APIRouter(prefix="/api", tags=["planning"],
 class RecurringIn(BaseModel):
     name: str
     amount: Decimal
-    rhythm: str
-    due_day: int
+    rhythm: Literal["monthly", "quarterly", "yearly"]
+    due_day: int = Field(ge=1, le=31)
     start_date: date | None = None
     end_date: date | None = None
     category_id: int | None = None
@@ -35,8 +37,8 @@ class RecurringOut(RecurringIn):
 class RecurringPatch(BaseModel):
     name: str | None = None
     amount: Decimal | None = None
-    rhythm: str | None = None
-    due_day: int | None = None
+    rhythm: Literal["monthly", "quarterly", "yearly"] | None = None
+    due_day: int | None = Field(default=None, ge=1, le=31)
     start_date: date | None = None
     end_date: date | None = None
     category_id: int | None = None
@@ -170,7 +172,7 @@ class LoanIn(BaseModel):
     annual_rate_pct: Decimal
     term_months: int
     payout_date: date
-    repayment_type: str = "annuity"
+    repayment_type: Literal["annuity", "bullet"] = "annuity"
 
 
 class LoanOut(LoanIn):
@@ -184,7 +186,7 @@ class LoanPatch(BaseModel):
     annual_rate_pct: Decimal | None = None
     term_months: int | None = None
     payout_date: date | None = None
-    repayment_type: str | None = None
+    repayment_type: Literal["annuity", "bullet"] | None = None
 
 
 class InstallmentOut(BaseModel):
@@ -227,6 +229,10 @@ def delete_loan(loan_id: int, session: Session = Depends(get_session)):
     loan = session.get(Loan, loan_id)
     if loan is None:
         raise HTTPException(404, "Kredit nicht gefunden")
+    # Remove scenario assignments first: no DB-level cascade exists, so a
+    # dangling ScenarioLoan row would raise a foreign-key violation (500 on
+    # Postgres).
+    session.execute(delete(ScenarioLoan).where(ScenarioLoan.loan_id == loan_id))
     session.delete(loan)
     session.commit()