Polish/audit: fix bugs found by 3 subsystem audits

Correctness/data:
- Fix demo cost double-count: reference importer no longer imports the Kosten Strom/Wasser
  columns for categories that are metered (only Heizung), so Wasser rollup is 70€ not 140€.
- Spurious-decrease guard: only a reset/swap in the window (prevReading, thisReading] explains
  a decrease — an old historical reset no longer permanently disables the guard.
- Gate swap auto-detection on MappingProfile.DetectCumulativeSwaps (flag was ignored).
- Prorate basePrice by bucket length (day/month/year); guard virtual expressions against NaN/Inf.

Concurrency/infra:
- Blazor: register a DbContextFactory; CostService/DashboardService and the read pages now use
  short-lived per-operation contexts (no shared circuit DbContext); guard Trends re-entrancy.
- /events: wrap event insert + consumption recompute in one transaction (atomic); 404 (not 500)
  on unknown meter.
- MQTT worker: subscribe to newly-added topics on each tick; move client cleanup into finally.
- Migrations: CREATE MATERIALIZED VIEW IF NOT EXISTS + if_not_exists on CAgg/compression/
  hypertable calls (re-run-safe after a mid-migration crash).
- HA worker: prune stale poll-schedule entries; export: null dangling ImportBatchIds on restore.

API/security:
- API fail-closed by default: with no keys and AllowAnonymousApi off, /api/v1 returns 401
  (protects /export and /import). New MeterVault:AllowAnonymousApi opt-in.
- Cap /readings batch at 5000; report ignored (unknown-meter) count; enums as strings in JSON.

+4 regression tests (guard window, API closed, /events 404, no demo double-count). 98 tests
green; Docker deploy re-verified healthy with the API fail-closed.

Claude-Session: https://claude.ai/code/session_01WujdMtMJPbxDpDnMeK22rr

src/Infrastructure/Import/CsvImporter.cs

@@ -46,7 +46,7 @@ public sealed class CsvImporter
 
             foreach (var column in profile.Columns)
             {
-                StageColumn(column, row, time, r, staged, previousByMeter);
+                StageColumn(column, row, time, r, staged, previousByMeter, profile.DetectCumulativeSwaps);
             }
         }
 
@@ -54,7 +54,7 @@ public sealed class CsvImporter
     }
 
     private static void StageColumn(ColumnMapping column, IReadOnlyList<string> row, DateTimeOffset time,
-        int rowIndex, StagedImport staged, Dictionary<int, double> previousByMeter)
+        int rowIndex, StagedImport staged, Dictionary<int, double> previousByMeter, bool detectSwaps)
     {
         if (column.Role == MappingRole.Ignore || column.Index >= row.Count)
         {
@@ -70,7 +70,7 @@ public sealed class CsvImporter
         switch (column.Role)
         {
             case MappingRole.Reading:
-                StageReading(column, row, cell, time, rowIndex, staged, previousByMeter);
+                StageReading(column, row, cell, time, rowIndex, staged, previousByMeter, detectSwaps);
                 break;
 
             case MappingRole.Delivery:
@@ -126,7 +126,7 @@ public sealed class CsvImporter
     }
 
     private static void StageReading(ColumnMapping column, IReadOnlyList<string> row, string cell,
-        DateTimeOffset time, int rowIndex, StagedImport staged, Dictionary<int, double> previousByMeter)
+        DateTimeOffset time, int rowIndex, StagedImport staged, Dictionary<int, double> previousByMeter, bool detectSwaps)
     {
         var split = ValueCell.Split(cell);
         if (split is null)
@@ -144,7 +144,7 @@ public sealed class CsvImporter
                 $"Row {rowIndex + 1}: expected unit '{column.Unit}' but found '{split.Value.Unit}'.");
         }
 
-        if (previousByMeter.TryGetValue(meterId, out var previous) && value < previous)
+        if (detectSwaps && previousByMeter.TryGetValue(meterId, out var previous) && value < previous)
         {
             var override_ = ReadSwapOverride(column, row);
             staged.Events.Add(new MeterEvent