fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/backup/backup-scheduler.service.spec.ts

@@ -0,0 +1,198 @@
+import { Logger } from '@nestjs/common';
+import { SchedulerRegistry } from '@nestjs/schedule';
+import { CronJob } from 'cron';
+import * as path from 'node:path';
+import { Prisma } from '../../generated/prisma';
+import { BackupSchedulerService } from './backup-scheduler.service';
+import { BackupService } from './backup.service';
+import { BackupSettingsService } from './backup-settings.service';
+
+jest.mock('node:fs/promises', () => ({
+  mkdir: jest.fn(),
+  writeFile: jest.fn(),
+  readdir: jest.fn(),
+  stat: jest.fn(),
+  unlink: jest.fn(),
+}));
+
+import * as fs from 'node:fs/promises';
+
+describe('BackupSchedulerService', () => {
+  const originalEnv = { ...process.env };
+  const directory = path.resolve('/data/backups');
+  let service: BackupSchedulerService;
+  let backupService: { exportSealed: jest.Mock };
+  let error: jest.SpyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.BACKUP_STORAGE_PATH = directory;
+    delete process.env.BACKUP_MAX_IMPORT_BYTES;
+    delete process.env.BACKUP_RETENTION_COUNT;
+    delete process.env.BACKUP_CRON_SCHEDULE;
+    error = jest.spyOn(Logger.prototype, 'error').mockImplementation(() => {});
+
+    backupService = {
+      exportSealed: jest.fn().mockResolvedValue({
+        format: 'apicore-backup',
+        exportedAt: '2026-10-12T03:00:00.000Z',
+        ciphertext: 'x'.repeat(2000),
+      }),
+    };
+    const settings = {
+      get: jest.fn().mockResolvedValue({
+        storagePath: null,
+        cronSchedule: null,
+        retentionCount: null,
+      }),
+    };
+    service = new BackupSchedulerService(
+      backupService as unknown as BackupService,
+      settings as unknown as BackupSettingsService,
+      {} as SchedulerRegistry,
+    );
+    (fs.mkdir as jest.Mock).mockResolvedValue(undefined);
+    (fs.writeFile as jest.Mock).mockResolvedValue(undefined);
+    (fs.readdir as jest.Mock).mockResolvedValue([]);
+  });
+
+  afterEach(() => {
+    error.mockRestore();
+    process.env = { ...originalEnv };
+  });
+
+  function onDisk(files: { name: string; size: number; mtime: string }[]) {
+    (fs.readdir as jest.Mock).mockResolvedValue(files.map((f) => f.name));
+    (fs.stat as jest.Mock).mockImplementation((filePath: string) => {
+      const file = files.find((f) => filePath.endsWith(f.name));
+      return Promise.resolve({
+        size: file?.size,
+        mtime: new Date(file!.mtime),
+      });
+    });
+  }
+
+  describe('getStatus', () => {
+    it('reports the import limit and the size of the newest backup', async () => {
+      process.env.BACKUP_MAX_IMPORT_BYTES = '1000';
+      onDisk([
+        {
+          name: 'apicore-backup-old.json',
+          size: 5000,
+          mtime: '2026-10-10T03:00:00.000Z',
+        },
+        {
+          name: 'apicore-backup-new.json',
+          size: 900,
+          mtime: '2026-10-11T03:00:00.000Z',
+        },
+      ]);
+
+      const status = await service.getStatus();
+
+      expect(status).toEqual(
+        expect.objectContaining({
+          importLimitBytes: 1000,
+          lastBackupSizeBytes: 900,
+          lastBackupExceedsImportLimit: false,
+        }),
+      );
+    });
+
+    it('warns when the newest backup could no longer be imported', async () => {
+      process.env.BACKUP_MAX_IMPORT_BYTES = '1000';
+      onDisk([
+        {
+          name: 'apicore-backup-new.json',
+          size: 1001,
+          mtime: '2026-10-11T03:00:00.000Z',
+        },
+      ]);
+
+      const status = await service.getStatus();
+
+      expect(status.lastBackupSizeBytes).toBe(1001);
+      expect(status.lastBackupExceedsImportLimit).toBe(true);
+    });
+
+    it('still reports the import limit while no schedule is configured', async () => {
+      delete process.env.BACKUP_STORAGE_PATH;
+
+      const status = await service.getStatus();
+
+      expect(status).toEqual(
+        expect.objectContaining({
+          enabled: false,
+          importLimitBytes: 50 * 1024 * 1024,
+          lastBackupSizeBytes: null,
+          lastBackupExceedsImportLimit: false,
+        }),
+      );
+    });
+  });
+
+  describe('runNow', () => {
+    it('keeps a backup larger than the import limit but logs an error', async () => {
+      process.env.BACKUP_MAX_IMPORT_BYTES = '1000';
+
+      const result = await service.runNow();
+
+      expect(fs.writeFile).toHaveBeenCalledTimes(1);
+      expect(result.fileName).toMatch(/^apicore-backup-.*\.json$/);
+      expect(error).toHaveBeenCalledTimes(1);
+      expect(error).toHaveBeenCalledWith(
+        expect.stringContaining('Import-Limit'),
+      );
+    });
+
+    it('logs nothing for a backup within the import limit', async () => {
+      await service.runNow();
+
+      expect(fs.writeFile).toHaveBeenCalledTimes(1);
+      expect(error).not.toHaveBeenCalled();
+    });
+  });
+
+  // The export reads every table through Prisma; a Prisma message quotes
+  // query values, so a failed scheduled run logs name, code and model only.
+  describe('scheduled run', () => {
+    it('logs a failed scheduled backup without the Prisma message', async () => {
+      const registry = {
+        doesExist: jest.fn().mockReturnValue(false),
+        addCronJob: jest.fn(),
+        deleteCronJob: jest.fn(),
+      };
+      const scheduled = new BackupSchedulerService(
+        backupService as unknown as BackupService,
+        {
+          get: jest.fn().mockResolvedValue({
+            storagePath: null,
+            cronSchedule: null,
+            retentionCount: null,
+          }),
+        } as unknown as BackupSettingsService,
+        registry as unknown as SchedulerRegistry,
+      );
+      backupService.exportSealed.mockRejectedValue(
+        new Prisma.PrismaClientKnownRequestError('title "Max Mustermann"', {
+          code: 'P2010',
+          clientVersion: '7.9.1',
+          meta: { modelName: 'Task' },
+        }),
+      );
+      await scheduled.reload();
+      const [[, job]] = registry.addCronJob.mock.calls as [[string, CronJob]];
+      await job.stop();
+
+      await job.fireOnTick();
+      await new Promise((resolve) => setImmediate(resolve));
+
+      const failure = error.mock.calls.find(([message]) =>
+        String(message).startsWith('Scheduled backup failed'),
+      ) as [string, unknown];
+      expect(failure[0]).toContain('P2010');
+      expect(failure[0]).not.toContain('Mustermann');
+      expect(failure[1]).toBeUndefined();
+    });
+  });
+});