fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/backup/backup.controller.ts

@@ -3,6 +3,7 @@ import {
   Body,
   Controller,
   Get,
+  Logger,
   Patch,
   Post,
   Res,
@@ -25,17 +26,18 @@ import {
 } from './backup-scheduler.service';
 import { BackupSettingsService } from './backup-settings.service';
 import { UpdateBackupSettingsDto } from './dto/update-backup-settings.dto';
-
-// A full backup bundle can be much larger than the 5mb CSV import cap
-// elsewhere (dozens of tables, potentially years of records, plus embedded
-// label-template images) - 50mb comfortably covers a real dataset without
-// raising the app-wide JSON body limit for every other route.
-const MAX_BACKUP_FILE_SIZE_BYTES = 50 * 1024 * 1024;
+import {
+  backupMaxImportBytes,
+  exceedsBackupImportLimit,
+  formatMegabytes,
+} from './backup-import-limit';
 
 @ApiTags('backup')
 @ApiBearerAuth()
 @Controller('backup')
 export class BackupController {
+  private readonly logger = new Logger(BackupController.name);
+
   constructor(
     private readonly backupService: BackupService,
     private readonly backupSchedulerService: BackupSchedulerService,
@@ -76,19 +78,29 @@ export class BackupController {
   @Get('export')
   async export(@Res() res: Response): Promise<void> {
     const sealed = await this.backupService.exportSealed();
+    const body = JSON.stringify(sealed);
+    const sizeBytes = Buffer.byteLength(body);
+    if (exceedsBackupImportLimit(sizeBytes)) {
+      // Still delivered: losing the data is worse than needing a raised
+      // BACKUP_MAX_IMPORT_BYTES to restore it. The UI compares the file
+      // against the limit from GET /backup/schedule and warns there.
+      this.logger.warn(
+        `Exportiertes Backup ist ${formatMegabytes(sizeBytes)} groß und überschreitet das Import-Limit von ${formatMegabytes(backupMaxImportBytes())} - eine Wiederherstellung würde scheitern`,
+      );
+    }
     const filename = `apicore-backup-${new Date().toISOString().slice(0, 10)}.json`;
     res.setHeader('Content-Type', 'application/json; charset=utf-8');
     res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
     res.setHeader('Cache-Control', 'no-store');
-    res.send(JSON.stringify(sealed));
+    res.send(body);
   }
 
   @RequirePermission('backup:import')
   @Post('import')
   @ApiConsumes('multipart/form-data')
   @UseInterceptors(
+    // Size limit from MulterModule in BackupModule (BACKUP_MAX_IMPORT_BYTES).
     FileInterceptor('file', {
-      limits: { fileSize: MAX_BACKUP_FILE_SIZE_BYTES },
       fileFilter: (_req, file, callback) => {
         if (!file.originalname.toLowerCase().endsWith('.json')) {
           callback(
@@ -117,6 +129,9 @@ export class BackupController {
     } catch {
       throw new BadRequestException('Datei ist kein gültiges JSON');
     }
-    return this.backupService.importFile(parsed, actor.id);
+    const summary = await this.backupService.importFile(parsed, actor.id);
+    // The backup may have restored the schedule's settings too.
+    await this.backupSchedulerService.reload();
+    return summary;
   }
 }