fix(archives): adamsreview re-review batch — 15 findings post-fix regressions (#136)

Fifth adamsreview fix batch — addresses 15 of the 20 findings from the
re-review (rev_01KRSME44NB8FEMR749FS5EQZA) that surfaced regressions
introduced by the prior 4 fix batches. Grouped into 5 fix-group sub-agents:

* Group AA — data integrity (F001+F002+F003)
  - F001: F008 sweep used wrong column 'archival_unit_id' for
    archive_unit_activities (correct: 'unit_id'). DELETE was silently
    failing with MySQL 1054, leaving orphan link rows after every
    archival_unit soft-delete.
  - F002: authorityDestroyAction now also sweeps archive_agent_relations
    (Phase 2 link table) clearing rows where the soft-deleted authority
    appears as agent_id OR related_id. Previously: ric.json kept emitting
    relations to deleted agents.
  - F003: removed 'place_id BIGINT UNSIGNED NULL' from
    ddlArchiveActivities() — fresh installs no longer create the column
    that migrate_0.7.12.sql then has to drop. Schema parity between
    fresh-install and upgrade paths restored.

* Group BB — wire \$relations into show views (F004+F005)
  - activityShowAction + placeShowAction now fetch
    archive_relations via fetchRelationsForEntity() and pass to the
    render. The 'Relazioni RiC-CM' panel on the activity/place detail
    pages was always empty before; now displays actual relations.
  - try/catch around the fetch — DB failure logs but degrades to empty
    list rather than 500-ing the page.

* Group CC — 15 missing locale keys (F009)
  - validateActivity/validatePlace error strings + F041 regex hints +
    F039 date placeholder were wrapped in __() but ABSENT from
    en_US/fr_FR/de_DE locale JSONs (commit d426f26 claimed 12 keys
    added; actually only 1 made it).
  - Added 15 keys per locale (60 lines total) with real translations
    in EN/FR/DE. Project i18n BLOCKING rule now satisfied.

* Group DD — view UX fixes (F006+F007+F008+F012)
  - F006: attach/detach forms on activities/show.php + places/show.php
    now include 'name=_return_to' hidden input so safeReturnTo() redirects
    back to the originating detail page instead of the main
    /admin/archives index.
  - F007: target_id input on attach forms is now a typeahead bound to
    /api/archives/entities autocomplete (debounced 200ms, XSS-safe via
    textContent, click-to-select, clears on target_type change,
    submit-block when no id selected). Pattern mirrors the canonical
    archives/show.php.
  - F008: detach buttons now use archivesSwalConfirm() SweetAlert2
    helper (already defined on the page) instead of native confirm().
    Consistent with the entity-delete buttons.
  - F012: geonames_id / wikidata_id / tgn_id inputs on places/form.php
    now apply conditional border-red-500 + render error message when
    F041 validation rejects.

* Group EE — validation cleanups + tests (F010+F011+F015+F016+F017)
  - F010: all 4 destroyAction handlers (archival_unit / authority /
    activity / place) wrapped in mysqli transactions with nested-
    transaction safety via @@autocommit detection. Soft-delete UPDATE
    + Phase 2/3/4 sweep DELETEs now succeed or fail atomically.
  - F011: inline comment on archive_unit_activities mirror in
    relationAttachAction documenting that predicate direction is
    preserved verbatim (canonical RiC-O inverse list deferred to
    v0.7.13).
  - F015: placeWouldCreateCycle now prepares the SELECT once outside
    the while loop instead of re-preparing every iteration (mirrors
    activityWouldCreateCycle's pattern).
  - F016: dropped 'AND deleted_at IS NULL' from placeWouldCreateCycle's
    SELECT — integrity walks must see the full topology (matches F018
    fix already applied to activityWouldCreateCycle).
  - F017: 5 new unit tests in tests/archives-ric-jsonld.unit.php
    covering buildRelationNode + @graph composition (167 → 172).

PHPStan level 5 clean. Unit tests 172/172. Smoke: ric.json 200,
OAI ric-o 200, admin 302→login. With this commit the re-review
cycle resolves the 15 highest-priority follow-ups. The 5 remaining
below_gate findings (F013, F014, F018, F019, F020 — score < 45)
are documented in trace.md for future cleanup.

Author: fabiodalez-dev

locale/de_DE.json

@@ -576,6 +576,7 @@
     "Cerca per ISBN-13": "Nach ISBN-13 suchen",
     "Cerca per codice EAN": "Nach EAN-Code suchen",
     "Cerca per nome autore (corrispondenza parziale)": "Nach Autorenname suchen (Teilübereinstimmung)",
+    "Cerca per nome o ID...": "Nach Name oder ID suchen...",
     "Cerca per nome, cognome, telefono, email o tessera": "Nach Name, Nachname, Telefon, E-Mail oder Ausweis suchen",
     "Cerca per nome...": "Nach Name suchen...",
     "Cerca per pseudonimo...": "Nach Pseudonym suchen...",

locale/en_US.json

@@ -576,6 +576,7 @@
     "Cerca per ISBN-13": "Search by ISBN-13",
     "Cerca per codice EAN": "Search by EAN code",
     "Cerca per nome autore (corrispondenza parziale)": "Search by author name (partial match)",
+    "Cerca per nome o ID...": "Search by name or ID...",
     "Cerca per nome, cognome, telefono, email o tessera": "Search by name, surname, phone, email or card",
     "Cerca per nome...": "Search by name...",
     "Cerca per pseudonimo...": "Search by pseudonym...",

locale/fr_FR.json

@@ -608,6 +608,7 @@
     "Cerca per ISBN-13": "Rechercher par ISBN-13",
     "Cerca per codice EAN": "Rechercher par code EAN",
     "Cerca per nome autore (corrispondenza parziale)": "Rechercher par nom d'auteur (correspondance partielle)",
+    "Cerca per nome o ID...": "Rechercher par nom ou ID...",
     "Cerca per nome, cognome, telefono, email o tessera": "Rechercher par nom, prénom, téléphone, e-mail ou carte",
     "Cerca per nome...": "Rechercher par nom...",
     "Cerca per pseudonimo...": "Rechercher par pseudonyme...",

locale/it_IT.json

@@ -70,6 +70,7 @@
     "Catalogo pubblico": "Catalogo pubblico",
     "Cerca": "Cerca",
     "Cerca \"%s\" su %s": "Cerca \"%s\" su %s",
+    "Cerca per nome o ID...": "Cerca per nome o ID...",
     "Cerca su:": "Cerca su:",
     "Cerca un authority record…": "Cerca un authority record…",
     "Chiave Google Books rimossa.": "Chiave Google Books rimossa.",

storage/plugins/archives/ArchivesPlugin.php

@@ -171,12 +171,16 @@ class="bg-red-50 hover:bg-red-100 text-red-700 px-4 py-2 rounded text-sm font-se
                     $tType = (string) ($rel['target_type'] ?? '');
                     $tId   = (int) ($rel['target_id'] ?? 0);
                 ?>
+                    <?php $relDetachId = 'archivesDetachRel_' . $relId; ?>
                     <li class="flex items-center gap-2">
                         <code class="text-xs text-gray-500 bg-gray-50 px-1 py-0.5 rounded"><?= $e($pred) ?></code>
                         <span><?= $e($tType) ?> #<?= $tId ?></span>
-                        <form method="POST" action="<?= $e(url('/admin/archives/relations/' . $relId . '/detach')) ?>" class="inline">
+                        <form id="<?= $e($relDetachId) ?>" method="POST" action="<?= $e(url('/admin/archives/relations/' . $relId . '/detach')) ?>" class="inline">
                             <input type="hidden" name="csrf_token" value="<?= $e(\App\Support\Csrf::ensureToken()) ?>">
-                            <button type="submit" onclick="return confirm('<?= $e(__('Scollegare questa relazione?')) ?>')" class="text-red-600 text-xs hover:underline">
+                            <input type="hidden" name="_return_to" value="<?= $e('/admin/archives/activities/' . $id) ?>">
+                            <button type="button"
+                                    onclick="archivesSwalConfirm(<?= $jsAttr($relDetachId) ?>, <?= $jsAttr(__('Scollegare questa relazione?')) ?>, <?= $jsAttr(__('scollega')) ?>)"
+                                    class="text-red-600 text-xs hover:underline">
                                 <?= __('scollega') ?>
                             </button>
                         </form>
@@ -185,18 +189,29 @@ class="bg-red-50 hover:bg-red-100 text-red-700 px-4 py-2 rounded text-sm font-se
             </ul>
         <?php endif; ?>
 
-        <form method="POST" action="<?= $e(url('/admin/archives/relations/attach')) ?>" class="mt-4 grid grid-cols-1 md:grid-cols-4 gap-2 text-sm">
+        <form method="POST" action="<?= $e(url('/admin/archives/relations/attach')) ?>"
+              class="mt-4 grid grid-cols-1 md:grid-cols-4 gap-2 text-sm"
+              data-archives-relation-attach>
             <input type="hidden" name="csrf_token" value="<?= $e(\App\Support\Csrf::ensureToken()) ?>">
             <input type="hidden" name="source_type" value="archive_activity">
             <input type="hidden" name="source_id" value="<?= $id ?>">
-            <select name="target_type" required class="rounded-md border-gray-300">
+            <input type="hidden" name="_return_to" value="<?= $e('/admin/archives/activities/' . $id) ?>">
+            <select name="target_type" id="rel_target_type" required class="rounded-md border-gray-300">
                 <option value=""><?= __('Tipo entità') ?></option>
                 <option value="archival_unit"><?= __('Unità archivistica') ?></option>
                 <option value="authority_record"><?= __('Agente') ?></option>
                 <option value="archive_activity"><?= __('Attività') ?></option>
                 <option value="archive_place"><?= __('Luogo') ?></option>
             </select>
-            <input type="number" name="target_id" required placeholder="<?= $e(__('ID target')) ?>" class="rounded-md border-gray-300">
+            <div class="relative">
+                <input type="text" id="rel_target_search" autocomplete="off"
+                       data-typeahead-input data-typeahead-target="rel_target_id"
+                       placeholder="<?= $e(__('Cerca per nome o ID...')) ?>"
+                       class="rounded-md border-gray-300 w-full">
+                <input type="hidden" id="rel_target_id" name="target_id" required>
+                <div data-typeahead-results
+                     class="absolute z-10 w-full bg-white border border-gray-200 rounded mt-1 shadow-lg hidden max-h-60 overflow-y-auto"></div>
+            </div>
             <input type="text" name="ric_predicate" required placeholder="ric:isOrWasRelatedTo" class="rounded-md border-gray-300">
             <button type="submit" class="bg-indigo-600 hover:bg-indigo-700 text-white px-3 py-1 rounded text-sm font-semibold"><?= __('Collega') ?></button>
         </form>
@@ -211,6 +226,105 @@ class="bg-red-50 hover:bg-red-100 text-red-700 px-4 py-2 rounded text-sm font-se
     </p>
 </div>
 
+<?php /* Relation-attach typeahead — fetches /api/archives/entities?type=&q=
+         and populates the visible/hidden input pair. Pattern mirrors
+         storage/plugins/archives/views/show.php (data-typeahead-*). */ ?>
+<script>
+(function () {
+    var form = document.querySelector('form[data-archives-relation-attach]');
+    if (!form) return;
+    var input   = form.querySelector('[data-typeahead-input]');
+    var results = form.querySelector('[data-typeahead-results]');
+    var hidden  = document.getElementById(input.dataset.typeaheadTarget);
+    var typeSel = form.querySelector('select[name="target_type"]');
+    if (!input || !results || !hidden || !typeSel) return;
+    var searchUrl = <?= json_encode(url('/api/archives/entities'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) ?>;
+    var noResultsMsg = <?= json_encode(__('Nessun risultato'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) ?>;
+    var debounceTimer = null;
+    var lastQuery = '';
+
+    function clearResults() { while (results.firstChild) results.removeChild(results.firstChild); }
+    function hideResults() { results.classList.add('hidden'); clearResults(); }
+
+    function renderResults(rows) {
+        clearResults();
+        if (!rows.length) {
+            var empty = document.createElement('div');
+            empty.className = 'px-3 py-2 text-gray-500 italic text-sm';
+            empty.textContent = noResultsMsg;
+            results.appendChild(empty);
+            results.classList.remove('hidden');
+            return;
+        }
+        for (var i = 0; i < rows.length; i++) {
+            var r = rows[i];
+            var div = document.createElement('div');
+            div.className = 'px-3 py-2 cursor-pointer hover:bg-blue-50 text-sm';
+            div.dataset.id = String(r.id);
+            var label = r.label || ('#' + r.id);
+            if (r.extra) { label += ' (' + r.extra + ')'; }
+            div.dataset.label = label;
+            div.textContent = label;
+            results.appendChild(div);
+        }
+        results.classList.remove('hidden');
+    }
+
+    function search(q, type) {
+        if (!type) { hideResults(); return; }
+        if (q.length < 2) { lastQuery = ''; hideResults(); return; }
+        var key = type + '|' + q;
+        if (key === lastQuery) return;
+        lastQuery = key;
+        var snapshot = key;
+        fetch(searchUrl + '?type=' + encodeURIComponent(type) + '&q=' + encodeURIComponent(q), { credentials: 'same-origin' })
+            .then(function (r) { return r.ok ? r.json() : { results: [] }; })
+            .then(function (data) {
+                if ((typeSel.value + '|' + input.value.trim()) !== snapshot) return;
+                renderResults(data.results || []);
+            })
+            .catch(function () {
+                if ((typeSel.value + '|' + input.value.trim()) === snapshot) hideResults();
+            });
+    }
+
+    input.addEventListener('input', function () {
+        clearTimeout(debounceTimer);
+        var q = input.value.trim();
+        hidden.value = '';
+        debounceTimer = setTimeout(function () { search(q, typeSel.value); }, 200);
+    });
+
+    typeSel.addEventListener('change', function () {
+        hidden.value = '';
+        input.value = '';
+        lastQuery = '';
+        hideResults();
+    });
+
+    results.addEventListener('click', function (ev) {
+        var div = ev.target.closest('[data-id]');
+        if (!div) return;
+        hidden.value = div.dataset.id;
+        input.value = div.dataset.label;
+        hideResults();
+    });
+
+    document.addEventListener('click', function (ev) {
+        if (!form.contains(ev.target)) hideResults();
+    });
+
+    form.addEventListener('submit', function (ev) {
+        if (!hidden.value) {
+            ev.preventDefault();
+            input.focus();
+            input.classList.add('border-red-400');
+            setTimeout(function () { input.classList.remove('border-red-400'); }, 1500);
+        }
+    });
+})();
+</script>
+
 <?php /* SweetAlert2 confirm helper — matches the pattern used in
           storage/plugins/archives/views/show.php. Idempotency guard so
           multiple views on the same page can load it without redefining. */ ?>

storage/plugins/archives/views/activities/show.php

@@ -128,19 +128,28 @@ class="mt-1 block w-full rounded-md <?= $err('longitude') ? 'border-red-500' : '
                 <label for="geonames_id" class="form-label"><?= __('Identificativo GeoNames') ?></label>
                 <input type="text" id="geonames_id" name="geonames_id" value="<?= $val('geonames_id') ?>"
                        placeholder="2525068"
-                       class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                       class="mt-1 block w-full rounded-md <?= $err('geonames_id') ? 'border-red-500' : 'border-gray-300' ?> shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                <?php if ($err('geonames_id')): ?>
+                    <p class="mt-1 text-sm text-red-600"><?= $e($err('geonames_id')) ?></p>
+                <?php endif; ?>
             </div>
             <div>
                 <label for="wikidata_id" class="form-label"><?= __('Identificativo Wikidata') ?></label>
                 <input type="text" id="wikidata_id" name="wikidata_id" value="<?= $val('wikidata_id') ?>"
                        placeholder="Q40218"
-                       class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                       class="mt-1 block w-full rounded-md <?= $err('wikidata_id') ? 'border-red-500' : 'border-gray-300' ?> shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                <?php if ($err('wikidata_id')): ?>
+                    <p class="mt-1 text-sm text-red-600"><?= $e($err('wikidata_id')) ?></p>
+                <?php endif; ?>
             </div>
             <div>
                 <label for="tgn_id" class="form-label"><?= __('Identificativo Getty TGN') ?></label>
                 <input type="text" id="tgn_id" name="tgn_id" value="<?= $val('tgn_id') ?>"
                        placeholder="7004329"
-                       class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                       class="mt-1 block w-full rounded-md <?= $err('tgn_id') ? 'border-red-500' : 'border-gray-300' ?> shadow-sm focus:border-indigo-500 focus:ring-indigo-500">
+                <?php if ($err('tgn_id')): ?>
+                    <p class="mt-1 text-sm text-red-600"><?= $e($err('tgn_id')) ?></p>
+                <?php endif; ?>
             </div>
         </div>