fix: resolve event-listener leaks and CSS gaps found in code quality audit

- notes.js (Critical): move grid click listener from renderGrid() to
  render() — was re-registered on every save/pin/delete, causing
  multiple API calls per user action after several interactions
- dashboard.js (Major): introduce AbortController (_fabController) so
  the anonymous document click listener from initFab() is cancelled on
  each new render() cycle; also remove the redundant initFab() call on
  the skeleton render
- layout.css (Major): extend .label selector to include .form-label,
  covering usage in notes.js and settings.js without a mass-rename
- test-modal-utils.js (Major): 12 unit tests for wireBlurValidation,
  btnSuccess, btnError; registered as test:modal-utils in package.json
- notes.js (Minor): add btnError() shake feedback to save error handler
- calendar.js (Minor): add popup.isConnected guard to closePopup so
  the listener self-removes correctly after navigation without a click

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

public/pages/calendar.js

@@ -695,7 +695,7 @@ function showEventPopup(ev, anchor) {
   // Schließen bei Klick außerhalb
   setTimeout(() => {
     document.addEventListener('click', function closePopup(e) {
-      if (!popup.contains(e.target)) {
+      if (!popup.isConnected || !popup.contains(e.target)) {
         popup.remove();
         document.removeEventListener('click', closePopup);
       }