Fix 12 bugs found in full-source audit of main

[vsdudakov]

Full-source bug audit of the main branch across the Python backend (models, service, ORM adapters, framework integrations) and the React/TS frontend. 12 confirmed bugs, each fixed with tests where applicable.

High severity

• Pony search crashes for non-id primary keys — ponyorm.py hardcoded .id; now uses get_model_pk_name, so search no longer 500s for models with a custom PK.
• JSON field with a date key breaks form save — transform.tsx detected dayjs via truthy value.date; now uses dayjs.isDayjs(), so a plain object no longer throws on submit.
• CheckboxGroup selections never render — antd Checkbox.Group is controlled via value, not checked; removed it from the valuePropName="checked" list.

Medium severity

• SQLAlchemy m2m filter → 500 — relationship fields now match via .any()/.has() on the related pk instead of a scalar comparison that raised InvalidRequestError.
• Pony mixed asc/desc ordering — Pony prepends each order_by() call, inverting priority; now built in a single call preserving declared order.
• Flask returned 500s as HTTP 200 and leaked exception text — now returns a real 500 with a generic, logged message.
• Flask 4xx errors were HTML, not JSON — centralized handler now returns {"detail": ...} matching the Django/FastAPI integrations, so the shared frontend can read the message.
• Text fields that look like dates got corrupted — transformValueFromServer coerced by shape alone; now widget-aware (only date widgets parse to dayjs), threaded through change/inline/async-select.
• Dashboard action errors silently swallowed — run/refresh handlers now catch and surface errors.

Low severity

• Empty sortable_by docstring — corrected the self-contradictory documentation to match code behavior.
• Filter values "true"/"false"/"null" coerced for all field types — sanitize_filter_value is now type-aware so text fields keep the literal strings; added a shared build_query_filters helper.
• invalidateQueries over-invalidated — updated to the react-query v5 { queryKey } signature.

Validation

• Python: full suite + new tests pass; ruff and ty clean.
• Frontend: full suite passes; tsc, biome, and eslint clean.