Fix 8 bugs from second code review

HIGH:
- Fix JS TypeError on empty API response: validate keys/types are arrays
  before using them; add HTTP status check (resp.ok)
- Fix BEGIN IMMEDIATE conflict: set isolation_level=None (autocommit) on
  SQLite connection so explicit transactions work without implicit ones

MEDIUM:
- Fix import_json_file non-atomic: wrap entire operation in BEGIN/COMMIT
  with ROLLBACK on error — no more partial imports
- Fix crash on non-dict batch_data items: skip non-dict elements
- Fix comma-in-key corruption: store keys/types as JSON arrays in hidden
  widgets instead of comma-delimited strings (backward-compat fallback)
- Fix blocking I/O in API routes: change async def to def so FastAPI
  auto-threads the synchronous SQLite calls

LOW:
- Fix missing ?. on app.graph.setDirtyCanvas in refreshDynamicOutputs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

project_loader.py

@@ -134,7 +134,13 @@ class ProjectLoaderDynamic:
                      output_keys="", output_types=""):
         data = _fetch_data(manager_url, project_name, file_name, sequence_number)
 
-        keys = [k.strip() for k in output_keys.split(",") if k.strip()] if output_keys else []
+        # Parse keys — try JSON array first, fall back to comma-split for compat
+        keys = []
+        if output_keys:
+            try:
+                keys = json.loads(output_keys)
+            except (json.JSONDecodeError, TypeError):
+                keys = [k.strip() for k in output_keys.split(",") if k.strip()]
 
         results = []
         for key in keys: