Fix 8 bugs from second code review

HIGH:
- Fix JS TypeError on empty API response: validate keys/types are arrays
  before using them; add HTTP status check (resp.ok)
- Fix BEGIN IMMEDIATE conflict: set isolation_level=None (autocommit) on
  SQLite connection so explicit transactions work without implicit ones

MEDIUM:
- Fix import_json_file non-atomic: wrap entire operation in BEGIN/COMMIT
  with ROLLBACK on error — no more partial imports
- Fix crash on non-dict batch_data items: skip non-dict elements
- Fix comma-in-key corruption: store keys/types as JSON arrays in hidden
  widgets instead of comma-delimited strings (backward-compat fallback)
- Fix blocking I/O in API routes: change async def to def so FastAPI
  auto-threads the synchronous SQLite calls

LOW:
- Fix missing ?. on app.graph.setDirtyCanvas in refreshDynamicOutputs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_project_loader.py

@@ -86,6 +86,20 @@ class TestProjectLoaderDynamic:
         assert result[2] == 1.5
         assert len(result) == MAX_DYNAMIC_OUTPUTS
 
+    def test_load_dynamic_with_json_encoded_keys(self):
+        """JSON-encoded output_keys should be parsed correctly."""
+        import json as _json
+        data = {"my,key": "comma_val", "normal": "ok"}
+        node = ProjectLoaderDynamic()
+        keys_json = _json.dumps(["my,key", "normal"])
+        with patch("project_loader._fetch_data", return_value=data):
+            result = node.load_dynamic(
+                "http://localhost:8080", "proj1", "batch_i2v", 1,
+                output_keys=keys_json
+            )
+        assert result[0] == "comma_val"
+        assert result[1] == "ok"
+
     def test_load_dynamic_empty_keys(self):
         node = ProjectLoaderDynamic()
         with patch("project_loader._fetch_data", return_value={"prompt": "hello"}):