feat(stock): batch movement ledger, production batches and shop write-back API

One remaining quantity per batch, kept in ApiCore and always derived:
initial quantity (jarCount / produced quantity) plus the signed movements
in the new BatchMovement ledger, which is never deleted.

- Production batches for MANUFACTURED articles (candles, propolis
  products, ...); articles get a kind and a shop category.
- Withdrawals (farm shop, own use, breakage, sample) and inventory
  corrections on bottlings and production batches, never more than the
  remaining stock; every write locks the bottling or the article row.
- Shop bookings via POST /shop-sync/movements (new scope
  shop-sync:write): idempotent per externalId, articles allocated oldest
  best-before first, returns mirrored onto the batches of the sale,
  invalid entries rejected one by one.
- GET /shop-sync/stock and remainingCount in the shop feed; webhook
  stock.changed after every change (ids only, receivers fetch numbers).
- Bottlings and production batches with movements cannot be deleted.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/auth/permissions/permission-catalog.ts

@@ -204,9 +204,22 @@ export const PERMISSION_CATALOG = [
       ['create', 'Anlegen'],
       ['update', 'Bearbeiten'],
       ['delete', 'Löschen'],
+      ['withdraw', 'Entnehmen und Inventur'],
     ],
     1600,
   ),
+  ...group(
+    'Herstellungschargen',
+    'production-batch',
+    [
+      ['read', 'Ansehen'],
+      ['create', 'Anlegen'],
+      ['update', 'Bearbeiten'],
+      ['delete', 'Löschen'],
+      ['withdraw', 'Entnehmen und Inventur'],
+    ],
+    1650,
+  ),
   ...group(
     'Etiketten',
     'label-templates',
@@ -324,7 +337,10 @@ export const PERMISSION_CATALOG = [
   ...group(
     'Shop-Synchronisation',
     'shop-sync',
-    [['read', 'Freigegebene Daten für den Shop lesen']],
+    [
+      ['read', 'Freigegebene Daten für den Shop lesen'],
+      ['write', 'Verkäufe und Rückbuchungen des Shops buchen'],
+    ],
     3300,
   ),
   ...group(