feat(export): Bestandsbuch für Tierarzneimittel nach Art. 108 VO (EU) 2019/6

- Treatment records supplier, purchase proof and prescribing vet, and
  keeps the apiary the colony stood at on the treatment day.
- Holder name and address in site settings (never in public output;
  regression test in public.service.spec).
- treatment-log.pdf: one sheet per apiary, identical treatments grouped,
  missing mandatory fields printed as FEHLT, uncertain locations marked.
- Shared PDF table helpers extracted from the record card.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/prisma/schema.prisma

@@ -205,6 +205,7 @@ model Apiary {
   colonies    Colony[]
   colonyMoves ColonyApiaryHistory[]
   harvests    Harvest[]
+  treatments  Treatment[]
 
   @@index([status])
 }
@@ -615,6 +616,14 @@ model Treatment {
   batchNumber          String?
   notes                String?
   withdrawalPeriodDays Int?
+  // Bestandsbuch (Art. 108 VO (EU) 2019/6): where the colony stood on the
+  // day of the treatment - kept with the treatment because the colony may
+  // be moved later - and the supplier / purchase proof / prescribing vet.
+  apiaryId             String?
+  apiary               Apiary?   @relation(fields: [apiaryId], references: [id])
+  supplier             String?
+  purchaseProof        String?
+  prescribingVet       String?
   createdAt            DateTime  @default(now())
 
   @@index([colonyId, date])
@@ -1102,12 +1111,16 @@ model AutomationRule {
 // site-wide social links exists, and a fixed-id upsert is simpler than
 // enforcing "at most one row" any other way.
 model SiteSettings {
-  id           String   @id @default("singleton")
-  youtubeUrl   String?
-  instagramUrl String?
-  tiktokUrl    String?
-  websiteUrl   String?
-  updatedAt    DateTime @updatedAt
+  id            String   @id @default("singleton")
+  youtubeUrl    String?
+  instagramUrl  String?
+  tiktokUrl     String?
+  websiteUrl    String?
+  // Name and address of the bee keeper, printed on the Bestandsbuch. Never
+  // part of any public page.
+  holderName    String?
+  holderAddress String?
+  updatedAt     DateTime @updatedAt
 }
 
 // ---------------------------------------------------------------------------