feat(stock): batch movement ledger, production batches and shop write-back API

One remaining quantity per batch, kept in ApiCore and always derived:
initial quantity (jarCount / produced quantity) plus the signed movements
in the new BatchMovement ledger, which is never deleted.

- Production batches for MANUFACTURED articles (candles, propolis
  products, ...); articles get a kind and a shop category.
- Withdrawals (farm shop, own use, breakage, sample) and inventory
  corrections on bottlings and production batches, never more than the
  remaining stock; every write locks the bottling or the article row.
- Shop bookings via POST /shop-sync/movements (new scope
  shop-sync:write): idempotent per externalId, articles allocated oldest
  best-before first, returns mirrored onto the batches of the sale,
  invalid entries rejected one by one.
- GET /shop-sync/stock and remainingCount in the shop feed; webhook
  stock.changed after every change (ids only, receivers fetch numbers).
- Bottlings and production batches with movements cannot be deleted.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/api-keys/api-key-scopes.ts

@@ -1,14 +1,17 @@
 import { PermissionKey } from '../auth/permissions/permission-catalog';
 
 /**
- * Permissions an API key may carry. Deliberately a short allowlist of
- * read-only permissions, not the whole catalog: a key is a long-lived secret
- * stored in another system, so it only ever gets what a machine integration
- * needs. Removing an entry here also takes it away from existing keys (see
+ * Permissions an API key may carry. Deliberately a short allowlist, not the
+ * whole catalog: a key is a long-lived secret stored in another system, so it
+ * only ever gets what a machine integration needs. shop-sync:write lets the
+ * shop book its own sales and returns - nothing else - and every booking is
+ * idempotent and kept in the ledger, so a leaked key cannot erase history.
+ * Removing an entry here also takes it away from existing keys (see
  * ApiKeysService.authenticate).
  */
 export const API_KEY_SCOPES = [
   'shop-sync:read',
+  'shop-sync:write',
 ] as const satisfies readonly PermissionKey[];
 
 export type ApiKeyScope = (typeof API_KEY_SCOPES)[number];