chore: maintenance — test coverage, route cleanup, README rewrite

- Add fmtHistVal and stateClass helper tests (7 new, 106 total)
- Add import regression test: missing name field returns 400 not 500
- Fix normalise() crash on missing name: body.name.trim() → (body.name ?? '').trim()
- Extract duplicate DB error handler into handleDbError() helper
- Rewrite README from scratch with audit log, export/import, full API docs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/api.test.js

@@ -303,6 +303,12 @@ describe('POST /api/import', () => {
   it('returns 400 if body has no instances key', async () => {
     expect((await request(app).post('/api/import').send({})).status).toBe(400)
   })
+
+  it('returns 400 (not 500) when a row is missing name', async () => {
+    const res = await request(app).post('/api/import')
+      .send({ instances: [{ ...base, name: undefined, vmid: 1 }] })
+    expect(res.status).toBe(400)
+  })
 })
 
 // ── Static assets & SPA routing ───────────────────────────────────────────────