fix: Final-Review-Findings (GUI-Login, FK-Kaskaden, Validierung, Duplikat-Recheck, Views)

F1: GUI-Login-Hash gegen $-Korruption gehaertet. .env-Werte einfach-gequotet
    geschrieben + Sanity-Check nach Sourcing. Zusaetzlich systemd-Ebene:
    podman escapt $->$$ in Environment=, systemd 252 kollabiert das nicht ->
    sed-Post-Processing der Unit-Dateien. Live-.env: GUI-Passwort rotiert.
F2: Explizite Dependent-Deletes gegen FK-500 (delete_scenario/loan), 409 bei
    bestaetigtem Import-Delete. Test-Engine erzwingt PRAGMA foreign_keys=ON.
F3: Enum/Range-Validierung (Literal + Field ge/le) fuer Recurring, Loan,
    Modifier inkl. PATCH-Pfade.
F4: Confirm nur fuer draft-Statements (sonst 409) + Dedup-Re-Check gegen
    bestaetigte Buchungen vor dem Promoten.
F5: v_balance_history/v_balance_total addieren pro Konto den opening_balance
    des fruehesten bestaetigten Statements (approved deviation vom Plan-SQL).
F6: patch_scenario Namenskollision -> 409; create_transaction unbekanntes
    Konto -> 404 (statt 500).
F7: Generierte systemd-Unit-Dateien chmod 600 (enthalten Env-Secrets).
F8: Globaler htmx:responseError-Handler in base.html.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

finance/app/routers/scenarios.py

@@ -1,16 +1,17 @@
 from datetime import date
 from decimal import Decimal
+from typing import Literal
 
 from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel, ConfigDict
-from sqlalchemy import select
+from sqlalchemy import delete, select
 from sqlalchemy.orm import Session
 
 from app.auth import require_auth
 from app.config import get_settings
 from app.db import get_session
-from app.models.tables import (Loan, ProjectionPoint, Scenario, ScenarioLoan,
-                               ScenarioModifier)
+from app.models.tables import (Loan, ProjectionPoint, ProjectionResult,
+                               Scenario, ScenarioLoan, ScenarioModifier)
 from app.services.projection_service import run_projection
 
 router = APIRouter(prefix="/api/scenarios", tags=["scenarios"],
@@ -37,9 +38,9 @@ class ScenarioPatch(BaseModel):
 
 
 class ModifierIn(BaseModel):
-    target_type: str
+    target_type: Literal["category", "recurring"]
     target_id: int
-    kind: str
+    kind: Literal["percent", "absolute", "remove"]
     value: Decimal = Decimal("0")
 
 
@@ -90,7 +91,13 @@ def create_scenario(data: ScenarioIn, session: Session = Depends(get_session)):
 def patch_scenario(scenario_id: int, data: ScenarioPatch,
                    session: Session = Depends(get_session)):
     scenario = _get_scenario(session, scenario_id)
-    for key, value in data.model_dump(exclude_unset=True).items():
+    fields = data.model_dump(exclude_unset=True)
+    if "name" in fields and fields["name"] != scenario.name:
+        clash = session.execute(
+            select(Scenario).where(Scenario.name == fields["name"])).scalar()
+        if clash is not None:
+            raise HTTPException(409, "Szenario existiert bereits")
+    for key, value in fields.items():
         setattr(scenario, key, value)
     session.commit()
     session.refresh(scenario)
@@ -100,6 +107,16 @@ def patch_scenario(scenario_id: int, data: ScenarioPatch,
 @router.delete("/{scenario_id}", status_code=204)
 def delete_scenario(scenario_id: int, session: Session = Depends(get_session)):
     scenario = _get_scenario(session, scenario_id)
+    # No DB-level cascades exist, so remove dependent rows explicitly to avoid
+    # foreign-key violations (would surface as a 500 on Postgres).
+    session.execute(delete(ProjectionPoint).where(
+        ProjectionPoint.scenario_id == scenario_id))
+    session.execute(delete(ProjectionResult).where(
+        ProjectionResult.scenario_id == scenario_id))
+    session.execute(delete(ScenarioLoan).where(
+        ScenarioLoan.scenario_id == scenario_id))
+    session.execute(delete(ScenarioModifier).where(
+        ScenarioModifier.scenario_id == scenario_id))
     session.delete(scenario)
     session.commit()