Fix 6 bugs found during code review

- Fix NameError: pass state to _render_vace_settings (tab_batch_ng.py)
- Fix non-atomic sync_to_db: use BEGIN IMMEDIATE transaction with rollback
- Fix create_secondary() missing db/current_project/db_enabled fields
- Fix URL encoding: percent-encode project/file names in API URLs
- Fix import_json_file crash on re-import: upsert instead of insert
- Fix dual DB instances: share single ProjectDB between UI and API routes
- Also fixes top_level metadata never being updated on existing data_files

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_db.py

@@ -246,6 +246,32 @@ class TestImport:
         seqs = db.list_sequences(df_id)
         assert seqs == []
 
+    def test_reimport_updates_existing(self, db, tmp_path):
+        """Re-importing the same file should update data, not crash."""
+        pid = db.create_project("p1", "/p1")
+        json_path = tmp_path / "batch.json"
+
+        # First import
+        data_v1 = {KEY_BATCH_DATA: [{"sequence_number": 1, "prompt": "v1"}]}
+        json_path.write_text(json.dumps(data_v1))
+        df_id_1 = db.import_json_file(pid, json_path, "i2v")
+
+        # Second import (same file, updated data)
+        data_v2 = {KEY_BATCH_DATA: [{"sequence_number": 1, "prompt": "v2"}, {"sequence_number": 2, "prompt": "new"}]}
+        json_path.write_text(json.dumps(data_v2))
+        df_id_2 = db.import_json_file(pid, json_path, "vace")
+
+        # Should reuse the same data_file row
+        assert df_id_1 == df_id_2
+        # Data type should be updated
+        df = db.get_data_file(pid, "batch")
+        assert df["data_type"] == "vace"
+        # Sequences should reflect v2
+        seqs = db.list_sequences(df_id_2)
+        assert seqs == [1, 2]
+        s1 = db.get_sequence(df_id_2, 1)
+        assert s1["prompt"] == "v2"
+
 
 # ------------------------------------------------------------------
 # Query helpers

tests/test_project_loader.py

@@ -61,6 +61,16 @@ class TestFetchHelpers:
         called_url = mock.call_args[0][0]
         assert "//api" not in called_url
 
+    def test_fetch_data_encodes_special_chars(self):
+        """Project/file names with spaces or special chars should be percent-encoded."""
+        data = {"prompt": "hello"}
+        with patch("project_loader.urllib.request.urlopen", return_value=_mock_urlopen(data)) as mock:
+            _fetch_data("http://localhost:8080", "my project", "batch file", 1)
+        called_url = mock.call_args[0][0]
+        assert "my%20project" in called_url
+        assert "batch%20file" in called_url
+        assert " " not in called_url.split("?")[0]  # no raw spaces in path
+
 
 class TestProjectLoaderDynamic:
     def test_load_dynamic_with_keys(self):