fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/honey-batches/dto/create-honey-batch.dto.ts

@@ -1,12 +1,13 @@
 import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
 import { IsNumber, IsOptional, IsString, Max, Min } from 'class-validator';
+import { IsOptionalNotNull } from '../../common/validation/is-optional-not-null';
 
 export class CreateHoneyBatchDto {
   @ApiPropertyOptional({
     description:
       'Wird automatisch generiert, falls die Automatisierung "Chargennummer-Format" aktiv ist',
   })
-  @IsOptional()
+  @IsOptionalNotNull()
   @IsString()
   batchNumber?: string;
 

ApiCore-Backend/src/honey-batches/dto/update-honey-batch.dto.ts

@@ -1,13 +1,15 @@
 import { ApiPropertyOptional, PartialType, PickType } from '@nestjs/swagger';
-import { IsEnum, IsOptional } from 'class-validator';
+import { IsEnum } from 'class-validator';
 import { HoneyBatchStatus } from '../../../generated/prisma';
 import { CreateHoneyBatchDto } from './create-honey-batch.dto';
+import { IsOptionalNotNull } from '../../common/validation/is-optional-not-null';
 
 /**
  * `storageContainerId` is editable here too, not only through
  * POST /honey-batches/:id/relocate: a batch recorded in the wrong container is
  * a data-entry error and must be correctable. The service writes the same
- * HoneyBatchRelocation entry the relocate endpoint writes.
+ * HoneyBatchRelocation entry the relocate endpoint writes. `null` removes the
+ * container assignment; that is no move, so only the audit entry records it.
  */
 class UpdatableHoneyBatchFieldsDto extends PartialType(
   PickType(CreateHoneyBatchDto, [
@@ -18,6 +20,7 @@ class UpdatableHoneyBatchFieldsDto extends PartialType(
     'waterContent',
     'storageContainerId',
   ] as const),
+  { skipNullProperties: false },
 ) {}
 
 export class UpdateHoneyBatchDto extends UpdatableHoneyBatchFieldsDto {
@@ -27,7 +30,7 @@ export class UpdateHoneyBatchDto extends UpdatableHoneyBatchFieldsDto {
    * undo a status that was set by mistake.
    */
   @ApiPropertyOptional({ enum: HoneyBatchStatus })
-  @IsOptional()
+  @IsOptionalNotNull()
   @IsEnum(HoneyBatchStatus)
   status?: HoneyBatchStatus;
 }

ApiCore-Backend/src/honey-batches/dto/update-honey-measurement.dto.ts

@@ -8,4 +8,5 @@ import { CreateHoneyMeasurementDto } from './create-honey-measurement.dto';
  */
 export class UpdateHoneyMeasurementDto extends PartialType(
   CreateHoneyMeasurementDto,
+  { skipNullProperties: false },
 ) {}

ApiCore-Backend/src/honey-batches/honey-batches.service.spec.ts

@@ -395,6 +395,32 @@ describe('HoneyBatchesService', () => {
       });
     });
 
+    it('removes the container assignment on null without a relocation', async () => {
+      prisma.honeyBatch.findUnique.mockResolvedValue({
+        ...honeyBatch,
+        storageContainerId: 'container-1',
+      });
+
+      await service.update(
+        'batch-1',
+        { storageContainerId: null as never },
+        'user-1',
+      );
+
+      const [[updateArg]] = prisma.honeyBatch.update.mock.calls as [
+        [{ data: { storageContainerId?: string | null } }],
+      ];
+      expect(updateArg.data.storageContainerId).toBeNull();
+      expect(prisma.honeyBatchRelocation.create).not.toHaveBeenCalled();
+      expect(auditLog.record).toHaveBeenCalledWith(
+        expect.objectContaining({
+          entityType: 'HoneyBatch',
+          entityId: 'batch-1',
+          action: 'UPDATE',
+        }),
+      );
+    });
+
     it('records no relocation when an edit leaves the container untouched', async () => {
       prisma.honeyBatch.findUnique.mockResolvedValue({
         ...honeyBatch,

ApiCore-Backend/src/honey-batches/honey-batches.service.ts

@@ -87,9 +87,15 @@ export class HoneyBatchesService {
 
   async update(id: string, dto: UpdateHoneyBatchDto, actingUserId: string) {
     const before = await this.findById(id);
-    const movesContainer =
-      dto.storageContainerId !== undefined &&
-      dto.storageContainerId !== before.storageContainerId;
+    // A relocation is a move into a container. null only removes the
+    // assignment - a batch may stand in no container, as it may be created
+    // without one - so it is recorded by the audit entry below, not as a
+    // relocation (which always needs a target container).
+    const movedToContainerId =
+      typeof dto.storageContainerId === 'string' &&
+      dto.storageContainerId !== before.storageContainerId
+        ? dto.storageContainerId
+        : null;
 
     await this.prisma.$transaction(async (tx) => {
       await tx.honeyBatch.update({
@@ -99,12 +105,12 @@ export class HoneyBatchesService {
       // Correcting the container has to leave the same trace a deliberate
       // relocation does - otherwise the batch's storage history would skip a
       // container it was recorded in.
-      if (movesContainer) {
+      if (movedToContainerId) {
         await tx.honeyBatchRelocation.create({
           data: {
             honeyBatchId: id,
             fromStorageContainerId: before.storageContainerId,
-            toStorageContainerId: dto.storageContainerId!,
+            toStorageContainerId: movedToContainerId,
             userId: actingUserId,
             notes: 'Korrektur über Honigcharge bearbeiten',
           },