feature(devices,topology,tz): devices bulk-add, duplicate safety, and firmware/timezone fixes

Squash-merge of PR #28 from @denis-ev. All three review blockers addressed: encryption key management documented, string truncation replaced with skip+warn validation, and undefined return on duplicate merge fixed with proper 500. Local test stack verified against cloned prod DB — migrations, new features, and backend all clean.

backend/src/services/PollerService.ts

@@ -656,9 +656,10 @@ export class PollerService {
         const installedVersion = (updateInfo['installed-version'] ?? '').trim();
         const statusText = (updateInfo['status'] ?? '').toLowerCase();
 
-        const hasUpdate =
+        const hasUpdate = Boolean(
           statusText.includes('available') ||
-          (latestVersion && installedVersion && latestVersion !== installedVersion);
+          (latestVersion && installedVersion && latestVersion !== installedVersion)
+        );
 
         // Read current flag before updating so we can detect first-discovery
         const current = await query<{ firmware_update_available: boolean }>(