fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/test/treatments.e2e-spec.ts

@@ -9,6 +9,14 @@ import { login } from './utils/api';
 interface TreatmentBody {
   id: string;
   colonyId: string;
+  startDate: string | null;
+  endDate: string | null;
+}
+
+interface WithdrawalStatusBody {
+  colonyId: string;
+  activeUntil: string;
+  product: string;
 }
 
 describe('Treatments (e2e)', () => {
@@ -116,4 +124,134 @@ describe('Treatments (e2e)', () => {
     const treatments = response.body as TreatmentBody[];
     expect(treatments.some((entry) => entry.id === treatmentId)).toBe(true);
   });
+
+  it('clears start and end date on null and audits the edit', async () => {
+    await request(app.getHttpServer())
+      .patch(`/api/v1/treatments/${treatmentId}`)
+      .set('Authorization', `Bearer ${beekeeperToken}`)
+      .send({ startDate: '2026-07-01', endDate: '2026-07-14' })
+      .expect(200);
+
+    const response = await request(app.getHttpServer())
+      .patch(`/api/v1/treatments/${treatmentId}`)
+      .set('Authorization', `Bearer ${beekeeperToken}`)
+      .send({ startDate: null, endDate: null })
+      .expect(200);
+    const treatment = response.body as TreatmentBody;
+    expect(treatment.startDate).toBeNull();
+    expect(treatment.endDate).toBeNull();
+    const auditEntry = await prisma.auditLog.findFirst({
+      where: {
+        entityType: 'Treatment',
+        entityId: treatmentId,
+        action: 'UPDATE',
+        userId: beekeeperId,
+      },
+      orderBy: { timestamp: 'desc' },
+    });
+    expect(auditEntry?.afterData).toEqual(
+      expect.objectContaining({ startDate: null, endDate: null }),
+    );
+  });
+
+  it.each(['date', 'product'])('rejects null for the required %s', (field) =>
+    request(app.getHttpServer())
+      .patch(`/api/v1/treatments/${treatmentId}`)
+      .set('Authorization', `Bearer ${beekeeperToken}`)
+      .send({ [field]: null })
+      .expect(400),
+  );
+
+  describe('withdrawal status for a harvest date', () => {
+    async function withdrawalStatusAt(at?: string) {
+      const response = await request(app.getHttpServer())
+        .get('/api/v1/treatments/withdrawal-status')
+        .query(
+          at === undefined
+            ? { colonyIds: colonyId }
+            : { colonyIds: colonyId, at },
+        )
+        .set('Authorization', `Bearer ${staffToken}`)
+        .expect(200);
+      return response.body as WithdrawalStatusBody[];
+    }
+
+    beforeAll(async () => {
+      // Ended 2026-07-01 with 14 days withdrawal: harvestable from 2026-07-15.
+      await request(app.getHttpServer())
+        .post('/api/v1/treatments')
+        .set('Authorization', `Bearer ${beekeeperToken}`)
+        .send({
+          colonyId,
+          date: '2026-06-20',
+          endDate: '2026-07-01',
+          product: 'Oxalsäure',
+          withdrawalPeriodDays: 14,
+        })
+        .expect(201);
+    });
+
+    it('reports the window as active on a harvest date inside it', async () => {
+      await expect(withdrawalStatusAt('2026-07-10')).resolves.toEqual([
+        {
+          colonyId,
+          activeUntil: '2026-07-15T00:00:00.000Z',
+          product: 'Oxalsäure',
+        },
+      ]);
+    });
+
+    it('accepts a full ISO timestamp', async () => {
+      await expect(
+        withdrawalStatusAt('2026-07-14T23:59:59.000Z'),
+      ).resolves.toHaveLength(1);
+    });
+
+    it('reports nothing once the window has ended by the harvest date', async () => {
+      await expect(withdrawalStatusAt('2026-07-15')).resolves.toEqual([]);
+    });
+
+    it('ignores a treatment that starts after the harvest date', async () => {
+      await expect(withdrawalStatusAt('2026-06-01')).resolves.toEqual([]);
+    });
+
+    it('evaluates against now without a date', async () => {
+      await expect(withdrawalStatusAt()).resolves.toEqual([]);
+    });
+
+    it('rejects asking for more than 200 colonies at once', async () => {
+      const ids = Array.from(
+        { length: 201 },
+        (_, index) => `cl${index.toString().padStart(23, '0')}`,
+      );
+      const response = await request(app.getHttpServer())
+        .get('/api/v1/treatments/withdrawal-status')
+        .query({ colonyIds: ids.join(',') })
+        .set('Authorization', `Bearer ${staffToken}`)
+        .expect(400);
+      expect(JSON.stringify(response.body)).toContain(
+        'colonyIds darf höchstens 200 Volk-IDs enthalten',
+      );
+    });
+
+    it.each(["colony'a", 'colony;drop', 'c'.repeat(65)])(
+      'rejects the invalid colony id %s',
+      (badId) =>
+        request(app.getHttpServer())
+          .get('/api/v1/treatments/withdrawal-status')
+          .query({ colonyIds: `${colonyId},${badId}` })
+          .set('Authorization', `Bearer ${staffToken}`)
+          .expect(400),
+    );
+
+    it.each(['gestern', '2026-02-30', '20260715', '2026-07-15T10Z', '2026'])(
+      'rejects the invalid date %s',
+      (at) =>
+        request(app.getHttpServer())
+          .get('/api/v1/treatments/withdrawal-status')
+          .query({ colonyIds: colonyId, at })
+          .set('Authorization', `Bearer ${staffToken}`)
+          .expect(400),
+    );
+  });
 });