Fix 6 bugs found during code review

- Fix NameError: pass state to _render_vace_settings (tab_batch_ng.py)
- Fix non-atomic sync_to_db: use BEGIN IMMEDIATE transaction with rollback
- Fix create_secondary() missing db/current_project/db_enabled fields
- Fix URL encoding: percent-encode project/file names in API URLs
- Fix import_json_file crash on re-import: upsert instead of insert
- Fix dual DB instances: share single ProjectDB between UI and API routes
- Also fixes top_level metadata never being updated on existing data_files

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_project_loader.py

@@ -61,6 +61,16 @@ class TestFetchHelpers:
         called_url = mock.call_args[0][0]
         assert "//api" not in called_url
 
+    def test_fetch_data_encodes_special_chars(self):
+        """Project/file names with spaces or special chars should be percent-encoded."""
+        data = {"prompt": "hello"}
+        with patch("project_loader.urllib.request.urlopen", return_value=_mock_urlopen(data)) as mock:
+            _fetch_data("http://localhost:8080", "my project", "batch file", 1)
+        called_url = mock.call_args[0][0]
+        assert "my%20project" in called_url
+        assert "batch%20file" in called_url
+        assert " " not in called_url.split("?")[0]  # no raw spaces in path
+
 
 class TestProjectLoaderDynamic:
     def test_load_dynamic_with_keys(self):