Polish/audit: fix bugs found by 3 subsystem audits

Correctness/data:
- Fix demo cost double-count: reference importer no longer imports the Kosten Strom/Wasser
  columns for categories that are metered (only Heizung), so Wasser rollup is 70€ not 140€.
- Spurious-decrease guard: only a reset/swap in the window (prevReading, thisReading] explains
  a decrease — an old historical reset no longer permanently disables the guard.
- Gate swap auto-detection on MappingProfile.DetectCumulativeSwaps (flag was ignored).
- Prorate basePrice by bucket length (day/month/year); guard virtual expressions against NaN/Inf.

Concurrency/infra:
- Blazor: register a DbContextFactory; CostService/DashboardService and the read pages now use
  short-lived per-operation contexts (no shared circuit DbContext); guard Trends re-entrancy.
- /events: wrap event insert + consumption recompute in one transaction (atomic); 404 (not 500)
  on unknown meter.
- MQTT worker: subscribe to newly-added topics on each tick; move client cleanup into finally.
- Migrations: CREATE MATERIALIZED VIEW IF NOT EXISTS + if_not_exists on CAgg/compression/
  hypertable calls (re-run-safe after a mid-migration crash).
- HA worker: prune stale poll-schedule entries; export: null dangling ImportBatchIds on restore.

API/security:
- API fail-closed by default: with no keys and AllowAnonymousApi off, /api/v1 returns 401
  (protects /export and /import). New MeterVault:AllowAnonymousApi opt-in.
- Cap /readings batch at 5000; report ignored (unknown-meter) count; enums as strings in JSON.

+4 regression tests (guard window, API closed, /events 404, no demo double-count). 98 tests
green; Docker deploy re-verified healthy with the API fail-closed.

Claude-Session: https://claude.ai/code/session_01WujdMtMJPbxDpDnMeK22rr

src/Infrastructure/Persistence/Migrations/20260713085642_TimescaleHypertables.cs

@@ -18,8 +18,9 @@ namespace MeterVault.Infrastructure.Persistence.Migrations
         protected override void Up(MigrationBuilder migrationBuilder)
         {
             // Raw readings: 30-day chunks; the (meter_id, time) PK contains the partition column.
+            // if_not_exists keeps a down-then-up cycle safe (Down leaves the hypertable in place).
             migrationBuilder.Sql(
-                "SELECT create_hypertable('reading', 'time', chunk_time_interval => INTERVAL '30 days');");
+                "SELECT create_hypertable('reading', 'time', chunk_time_interval => INTERVAL '30 days', if_not_exists => TRUE);");
 
             // Columnar compression, segmented by meter (monotonic sensor data compresses ~10-20x).
             migrationBuilder.Sql(
@@ -29,11 +30,11 @@ namespace MeterVault.Infrastructure.Persistence.Migrations
                 "timescaledb.compress_orderby = 'time DESC');");
 
             migrationBuilder.Sql(
-                "SELECT add_compression_policy('reading', INTERVAL '30 days');");
+                "SELECT add_compression_policy('reading', INTERVAL '30 days', if_not_exists => true);");
 
             // Normalized consumption: 90-day chunks. Kept effectively forever (small), so no compression policy.
             migrationBuilder.Sql(
-                "SELECT create_hypertable('consumption', 'time', chunk_time_interval => INTERVAL '90 days');");
+                "SELECT create_hypertable('consumption', 'time', chunk_time_interval => INTERVAL '90 days', if_not_exists => TRUE);");
         }
 
         /// <inheritdoc />

src/Infrastructure/Persistence/Migrations/20260713094634_ContinuousAggregates.cs

@@ -40,8 +40,11 @@ namespace MeterVault.Infrastructure.Persistence.Migrations
 
         private static void CreateAggregate(MigrationBuilder builder, string name, string bucket)
         {
+            // IF NOT EXISTS + if_not_exists keep this re-run-safe: because the statements suppress
+            // the transaction, a crash before __EFMigrationsHistory is written would otherwise brick
+            // the next migrate by re-creating an object that already exists.
             builder.Sql(
-                $"CREATE MATERIALIZED VIEW {name} WITH (timescaledb.continuous) AS " +
+                $"CREATE MATERIALIZED VIEW IF NOT EXISTS {name} WITH (timescaledb.continuous) AS " +
                 $"SELECT time_bucket(INTERVAL '{bucket}', time, '{Timezone}') AS bucket, " +
                 "meter_id, kind, sum(amount) AS amount " +
                 "FROM consumption GROUP BY bucket, meter_id, kind WITH NO DATA;",
@@ -54,7 +57,8 @@ namespace MeterVault.Infrastructure.Persistence.Migrations
                 $"SELECT add_continuous_aggregate_policy('{name}', " +
                 $"start_offset => INTERVAL '{startOffset}', " +
                 $"end_offset => INTERVAL '{endOffset}', " +
-                "schedule_interval => INTERVAL '1 hour');",
+                "schedule_interval => INTERVAL '1 hour', " +
+                "if_not_exists => true);",
                 suppressTransaction: true);
         }
     }