fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/test/honey-batches.e2e-spec.ts

@@ -30,11 +30,15 @@ describe('Honey batches (e2e)', () => {
   let prisma: PrismaService;
   const beekeeperEmail = `honey-batches-e2e-beekeeper-${Date.now()}@example.com`;
   const staffEmail = `honey-batches-e2e-staff-${Date.now()}@example.com`;
+  const adminEmail = `honey-batches-e2e-admin-${Date.now()}@example.com`;
   const password = 'SuperSecret123!';
   let beekeeperId: string;
   let staffId: string;
   let beekeeperToken: string;
   let staffToken: string;
+  // Correcting a batch (PATCH) is an ADMIN permission.
+  let adminId: string;
+  let adminToken: string;
   let apiaryId: string;
   let colonyId: string;
   let harvestId: string;
@@ -66,8 +70,18 @@ describe('Honey batches (e2e)', () => {
       },
     });
     staffId = staff.id;
+    const admin = await prisma.user.create({
+      data: {
+        email: adminEmail,
+        passwordHash,
+        name: 'Admin',
+        role: { connect: { key: 'ADMIN' } },
+      },
+    });
+    adminId = admin.id;
     beekeeperToken = (await login(app, beekeeperEmail, password)).accessToken;
     staffToken = (await login(app, staffEmail, password)).accessToken;
+    adminToken = (await login(app, adminEmail, password)).accessToken;
 
     const apiary = await prisma.apiary.create({
       data: { name: `Stand ${Date.now()}` },
@@ -121,13 +135,13 @@ describe('Honey batches (e2e)', () => {
     await prisma.colony.deleteMany({ where: { id: colonyId } });
     await prisma.apiary.deleteMany({ where: { id: apiaryId } });
     await prisma.refreshToken.deleteMany({
-      where: { userId: { in: [beekeeperId, staffId] } },
+      where: { userId: { in: [beekeeperId, staffId, adminId] } },
     });
     await prisma.auditLog.deleteMany({
-      where: { userId: { in: [beekeeperId, staffId] } },
+      where: { userId: { in: [beekeeperId, staffId, adminId] } },
     });
     await prisma.user.deleteMany({
-      where: { id: { in: [beekeeperId, staffId] } },
+      where: { id: { in: [beekeeperId, staffId, adminId] } },
     });
     await app.close();
   });
@@ -207,4 +221,38 @@ describe('Honey batches (e2e)', () => {
     expect(relocations[1].toStorageContainerId).toBe(containerAId);
     expect(relocations[1].fromStorageContainerId).toBeNull();
   });
+
+  it('removes the container on null without recording a relocation', async () => {
+    const response = await request(app.getHttpServer())
+      .patch(`/api/v1/honey-batches/${honeyBatchId}`)
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ storageContainerId: null })
+      .expect(200);
+    expect((response.body as HoneyBatchBody).storageContainerId).toBeNull();
+
+    const relocations = await prisma.honeyBatchRelocation.count({
+      where: { honeyBatchId },
+    });
+    expect(relocations).toBe(2);
+    const auditEntry = await prisma.auditLog.findFirst({
+      where: {
+        entityType: 'HoneyBatch',
+        entityId: honeyBatchId,
+        action: 'UPDATE',
+        userId: adminId,
+      },
+      orderBy: { timestamp: 'desc' },
+    });
+    expect(auditEntry?.afterData).toEqual(
+      expect.objectContaining({ storageContainerId: null }),
+    );
+  });
+
+  it('rejects null for the required batch number', () => {
+    return request(app.getHttpServer())
+      .patch(`/api/v1/honey-batches/${honeyBatchId}`)
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ batchNumber: null })
+      .expect(400);
+  });
 });