Add batch management APIs, API security, rate limiting, and optimizations

- Batch device CRUD: POST /api/devices/batch (create 500), PUT /api/devices/batch (update 500),
  POST /api/devices/batch-delete (delete 100) with WHERE IN bulk queries
- Batch command: POST /api/commands/batch with model_validator mutual exclusion
- API key auth (X-API-Key header, secrets.compare_digest timing-safe)
- Rate limiting via SlowAPIMiddleware (60/min default, 30/min writes)
- Real client IP extraction (X-Forwarded-For / CF-Connecting-IP)
- Global exception handler (no stack trace leaks, passes HTTPException through)
- CORS with auto-disable credentials on wildcard origins
- Schema validation: IMEI pattern, lat/lon ranges, Literal enums, MAC/UUID patterns
- Heartbeats router, per-ID endpoints for locations/attendance/bluetooth
- Input dedup in batch create, result ordering preserved
- Baidu reverse geocoding, Gaode map tiles with WGS84→GCJ02 conversion
- Device detail panel with feature toggles and command controls
- Side panel for location/beacon pages with auto-select active device

via [HAPI](https://hapi.run)

Co-Authored-By: HAPI <noreply@hapi.run>

app/routers/beacons.py

@@ -70,7 +70,6 @@ async def create_beacon(body: BeaconConfigCreate, db: AsyncSession = Depends(get
     if existing:
         raise HTTPException(status_code=400, detail=f"Beacon MAC {body.beacon_mac} already exists")
     beacon = await beacon_service.create_beacon(db, body)
-    await db.commit()
     return APIResponse(message="Beacon created", data=BeaconConfigResponse.model_validate(beacon))
 
 
@@ -85,7 +84,6 @@ async def update_beacon(
     beacon = await beacon_service.update_beacon(db, beacon_id, body)
     if beacon is None:
         raise HTTPException(status_code=404, detail="Beacon not found")
-    await db.commit()
     return APIResponse(message="Beacon updated", data=BeaconConfigResponse.model_validate(beacon))
 
 
@@ -98,5 +96,4 @@ async def delete_beacon(beacon_id: int, db: AsyncSession = Depends(get_db)):
     success = await beacon_service.delete_beacon(db, beacon_id)
     if not success:
         raise HTTPException(status_code=404, detail="Beacon not found")
-    await db.commit()
     return APIResponse(message="Beacon deleted")