fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/colonies/colonies.service.spec.ts

@@ -313,6 +313,17 @@ describe('ColoniesService', () => {
     ).rejects.toBeInstanceOf(ConflictException);
   });
 
+  it.each(['WEAK', 'CONSPICUOUS', 'QUEENLESS'])(
+    'reactivate rejects a %s colony that was never ended',
+    async (status) => {
+      prisma.colony.findUnique.mockResolvedValue({ ...parentColony, status });
+      await expect(
+        service.reactivate('colony-1', 'user-1'),
+      ).rejects.toBeInstanceOf(ConflictException);
+      expect(prisma.colony.update).not.toHaveBeenCalled();
+    },
+  );
+
   it('reactivate sets status ACTIVE and clears deactivatedAt', async () => {
     prisma.colony.findUnique.mockResolvedValue({
       ...parentColony,

ApiCore-Backend/src/colonies/colonies.service.ts

@@ -317,7 +317,9 @@ export class ColoniesService {
 
   async reactivate(id: string, actingUserId: string): Promise<Colony> {
     const before = await this.findById(id);
-    if (before.status === 'ACTIVE') {
+    // Only an ended colony can be brought back. A weak or queenless one
+    // still exists - reactivating it would just overwrite its condition.
+    if (isLivingColonyStatus(before.status)) {
       throw new ConflictException('Colony is already active');
     }
     const colony = await this.prisma.colony.update({

ApiCore-Backend/src/colonies/colony-status.ts

@@ -1,4 +1,4 @@
-import { ColonyStatus } from '../../generated/prisma';
+import { ColonyStatus, Prisma } from '../../generated/prisma';
 
 /**
  * Statuses after which a colony no longer exists as a living unit. The other
@@ -16,3 +16,8 @@ export const TERMINAL_COLONY_STATUSES: readonly ColonyStatus[] = [
 export function isLivingColonyStatus(status: ColonyStatus): boolean {
   return !TERMINAL_COLONY_STATUSES.includes(status);
 }
+
+/** The same rule as a query filter: colonies that still exist. */
+export const LIVING_COLONY_WHERE = {
+  status: { notIn: [...TERMINAL_COLONY_STATUSES] },
+} satisfies Prisma.ColonyWhereInput;

ApiCore-Backend/src/colonies/dto/update-colony.dto.ts

@@ -1,7 +1,8 @@
 import { ApiPropertyOptional, PartialType, PickType } from '@nestjs/swagger';
-import { IsEnum, IsOptional } from 'class-validator';
+import { IsEnum } from 'class-validator';
 import { ColonyStatus } from '../../../generated/prisma';
 import { CreateColonyDto } from './create-colony.dto';
+import { IsOptionalNotNull } from '../../common/validation/is-optional-not-null';
 
 /**
  * `apiaryId` is editable here too, not only through POST /colonies/:id/move:
@@ -22,11 +23,12 @@ class UpdatableColonyFieldsDto extends PartialType(
     'healthStatus',
     'notes',
   ] as const),
+  { skipNullProperties: false },
 ) {}
 
 export class UpdateColonyDto extends UpdatableColonyFieldsDto {
   @ApiPropertyOptional({ enum: ColonyStatus })
-  @IsOptional()
+  @IsOptionalNotNull()
   @IsEnum(ColonyStatus)
   status?: ColonyStatus;
 }