fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/backup/backup.controller.spec.ts

@@ -0,0 +1,100 @@
+import { Logger } from '@nestjs/common';
+import type { Response } from 'express';
+import { BackupController } from './backup.controller';
+import { BackupService } from './backup.service';
+import { BackupSchedulerService } from './backup-scheduler.service';
+import { BackupSettingsService } from './backup-settings.service';
+import { ReauthService } from '../auth/reauth/reauth.service';
+import type { AuthenticatedUser } from '../auth/types/authenticated-user';
+
+describe('BackupController', () => {
+  const originalLimit = process.env.BACKUP_MAX_IMPORT_BYTES;
+  let controller: BackupController;
+  let backupService: { importFile: jest.Mock; exportSealed: jest.Mock };
+  let scheduler: { reload: jest.Mock };
+  let reauth: { verify: jest.Mock };
+  const actor = { id: 'admin-1' } as AuthenticatedUser;
+  const file = {
+    buffer: Buffer.from(JSON.stringify({ format: 'apicore-backup' })),
+  } as Express.Multer.File;
+
+  beforeEach(() => {
+    delete process.env.BACKUP_MAX_IMPORT_BYTES;
+    backupService = {
+      importFile: jest.fn().mockResolvedValue({ imported: {}, skipped: [] }),
+      exportSealed: jest.fn().mockResolvedValue({
+        format: 'apicore-backup',
+        exportedAt: '2026-10-12T03:00:00.000Z',
+        ciphertext: 'x'.repeat(2000),
+      }),
+    };
+    scheduler = { reload: jest.fn().mockResolvedValue(undefined) };
+    reauth = { verify: jest.fn().mockResolvedValue(undefined) };
+    controller = new BackupController(
+      backupService as unknown as BackupService,
+      scheduler as unknown as BackupSchedulerService,
+      {} as BackupSettingsService,
+      reauth as unknown as ReauthService,
+    );
+  });
+
+  afterEach(() => {
+    if (originalLimit === undefined) {
+      delete process.env.BACKUP_MAX_IMPORT_BYTES;
+    } else {
+      process.env.BACKUP_MAX_IMPORT_BYTES = originalLimit;
+    }
+  });
+
+  it('re-registers the backup schedule after an import, since it may restore other backup settings', async () => {
+    await controller.import(file, { password: 'secret' }, actor);
+
+    expect(backupService.importFile).toHaveBeenCalledTimes(1);
+    expect(scheduler.reload).toHaveBeenCalledTimes(1);
+    expect(scheduler.reload.mock.invocationCallOrder[0]).toBeGreaterThan(
+      backupService.importFile.mock.invocationCallOrder[0],
+    );
+  });
+
+  it('leaves the schedule alone when the import fails', async () => {
+    backupService.importFile.mockRejectedValue(new Error('broken file'));
+
+    await expect(
+      controller.import(file, { password: 'secret' }, actor),
+    ).rejects.toThrow('broken file');
+    expect(scheduler.reload).not.toHaveBeenCalled();
+  });
+
+  describe('export', () => {
+    let warn: jest.SpyInstance;
+    let res: { setHeader: jest.Mock; send: jest.Mock };
+
+    beforeEach(() => {
+      warn = jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => {});
+      res = { setHeader: jest.fn(), send: jest.fn() };
+    });
+
+    afterEach(() => {
+      warn.mockRestore();
+    });
+
+    it('still delivers a backup larger than the import limit, but logs a warning', async () => {
+      process.env.BACKUP_MAX_IMPORT_BYTES = '1000';
+
+      await controller.export(res as unknown as Response);
+
+      expect(res.send).toHaveBeenCalledTimes(1);
+      expect(warn).toHaveBeenCalledTimes(1);
+      expect(warn).toHaveBeenCalledWith(
+        expect.stringContaining('Import-Limit'),
+      );
+    });
+
+    it('logs nothing for a backup within the import limit', async () => {
+      await controller.export(res as unknown as Response);
+
+      expect(res.send).toHaveBeenCalledTimes(1);
+      expect(warn).not.toHaveBeenCalled();
+    });
+  });
+});