Address code-review findings (Rust + JS + PS) toward 10/10

[zerox80]

Comprehensive follow-up to the manual code review. All CI gates stay green:

• \cargo fmt --check\ clean
• \cargo clippy --all-targets -- -D warnings\ clean
• \cargo test --all\ -> 33 passed, 0 failed
• 
  ode --test\ -> 5 passed, 0 failed (golden-vector parity intact)
• PowerShell parser OK on all edited scripts

Summary by area

Rust backend

• atomic.rs (High): the stale-lock takeover used a non-atomic \stale-check -> remove_file -> create_new\ pattern that could rob a slow-but-living writer of its lock. Replaced with PID-liveness-gated atomic rename-to-tombstone: we only take over when we can confirm the holder PID is no longer active (OpenProcess + GetExitCodeProcess with ERROR_INVALID_PARAMETER detection), and use an atomic rename (vs. remove+create) so two contenders can't both succeed. Documented the residual behaviour.
• common.rs: removed speculative Win11 build 26200 ('25H2'), added 22000 RTM.
• inventory.rs: clamp implausible ageYears (<0, >30y, NaN/Inf) to None instead of producing absurd displays and skewing buckets.
• merge.rs / assignments.rs: extracted \effective_display()\ to dedupe the \user_display vempty -> fall back to user\ logic across three sites; dropped redundant \�ios/\win11\ clones.
• overview.rs (Medium): collapsed nine separate scans into a single-pass accumulation of status tallies, dept map, needs_upgrade total, and RAM buckets; \current\ semantics documented.
• commands.rs: avoid full \Vec\ clone in the AD-fallback path (\allback_users_from_devices\ takes &).
• config.rs: \control_dir_for\ no longer falls back to a relative empty path for single-segment \data_dir\ inputs; relies on the absolute-path gate downstream.
• upgrade.rs: documented the inclusive \minRamGB\ boundary (covered by golden vectors).

Frontend

• (Critical) Counter drift: the dashboard 'Upgrade' tag used \o.status.upgrade\ while the nav badge and inventory segment used \o.upgradeNeeded; unified to \o.upgradeNeeded\ everywhere.
• (High) Row styling: rows now use \ViewModel.isUpgradeCandidate\ so stale-with-reason devices in the Upgrade filter are visually promoted instead of dimmed.
• view-model.js (Medium): locale-aware collation (\de, numeric:true) — umlaut surnames and hostnames \WS-AB-2\ vs \WS-AB-10\ sort correctly; sort-key cache replaces repeated \ oLowerCase\ per comparison; unused \sortValue\ removed.
• app-panels.js: search input debounced 150ms (matching the AD modal); refresh button guarded against double-clicks; Escape closes only the topmost layer (modal before drawer).
• app.js: drawer foot moved out of \drawer-body\ so it stops scrolling with the body; _TAURI_\ read at call time; \Number(x) || default\ pattern replaced with \Number.isFinite\ checks; dead \�isibleCount==null\ branch removed.
• shared.js / mock.js: \DEFAULT_THRESHOLDS\ deduped into \shared.js; \cpuClockMhz\ now derives from realistic per-PC clock values (was always 0 — the CPU-clock threshold was a no-op in preview); mock \set_assignment\ returns \device\ activating the optimistic UI path; \upgrade_reasons\ snake-case fallback removed.
• dev-server.js: \X-Content-Type-Options: nosniff, \X-Frame-Options: DENY, \Referrer-Policy: no-referrer.
• index.html: the static 'AD verbunden' label flacked on first paint → 'AD wird geladen'.

PowerShell

• Get-AdUsers.ps1 (High): force UTF-8 (no BOM) stdout so umlauts survive the Rust/serde_json parse; dispose \SearchResultCollection; drop dead
  ull-check on the env-var cast.
• Invoke-Inventory.ps1: prefer \Win32_ComputerSystem.DNSHostName\ over the 15-char NetBIOS \Name; \slotsTotal\ sums across all \Win32_PhysicalMemoryArray\ instances (multi-socket); added \MSFT_PhysicalDisk\ fallback via
  oot\Microsoft\Windows\Storage\ before falling back to the unreliable model-string regex; clamp implausible ageYears; documented \LastLoggedOnUser\ reliability and \win11\ (TPM/SecureBoot) preflight semantics; logs written as UTF-8 without BOM.
• Remove-StaleInventory.ps1 (High): per-file try/catch so a single locked file no longer aborts the cleanup sweep; \schemaVersion\ validated as positive int in range.

Verification

\
cd app/src-tauri && cargo fmt --all -- --check && cargo test --all && cargo clippy --all-targets -- -D warnings
cd app && node --check src/shared.js && node --check src/view-model.js && node --check src/app.js && node --check src/app-panels.js && node --check src/mock.js && node --check dev-server.js && node --test tests/upgrade-parity.test.js tests/view-model.test.js
\
All green.