feature(devices,topology,tz): devices bulk-add, duplicate safety, and firmware/timezone fixes

Squash-merge of PR #28 from @denis-ev. All three review blockers addressed: encryption key management documented, string truncation replaced with skip+warn validation, and undefined return on duplicate merge fixed with proper 500. Local test stack verified against cloned prod DB — migrations, new features, and backend all clean.

backend/src/utils/crypto.ts

@@ -1,3 +1,11 @@
+/**
+ * AES-256-GCM helpers for encrypting device credentials at rest in PostgreSQL.
+ *
+ * Key material: set `ENCRYPTION_KEY` in the environment (see README). If unset,
+ * a development-only default is used — production deployments must set a
+ * strong secret. Key rotation / recovery is documented under README
+ * "Credential encryption (ENCRYPTION_KEY)".
+ */
 import * as crypto from 'crypto';
 
 const ALGORITHM = 'aes-256-gcm';