fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/app/(app)/layout.spec.tsx

@@ -0,0 +1,75 @@
+import { describe, expect, it, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+import { Card, CardContent } from "@/components/ui/card";
+import { StickySubmit } from "@/components/form/sticky-submit";
+import AppLayout from "./layout";
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ replace: vi.fn(), push: vi.fn() }),
+  usePathname: () => "/inspections/new",
+}));
+
+vi.mock("@/lib/auth/auth-context", () => ({
+  useAuth: () => ({
+    user: {
+      id: "u1",
+      email: "[email protected]",
+      name: "Test Imker",
+      roleKey: "admin",
+      roleName: "Admin",
+      permissions: [],
+      mfaEnabled: false,
+      hasAvatar: false,
+    },
+    isLoading: false,
+    logout: vi.fn(),
+  }),
+}));
+
+vi.mock("@/components/notification-bell", () => ({ NotificationBell: () => null }));
+vi.mock("@/components/offline-sync-badge", () => ({ OfflineSyncBadge: () => null }));
+vi.mock("@/components/user-avatar", () => ({ UserAvatar: () => null }));
+
+// A box with overflow auto/scroll/hidden is a scroll container. Any such
+// ancestor of the page content captures `position: sticky` (StickySubmit),
+// and since the page itself scrolls on the window, the bar would never stick.
+const SCROLL_CONTAINER_CLASS = /(^|\s)([a-z]+:)*overflow-(x-|y-)?(auto|scroll|hidden)(\s|$)/;
+
+function expectNoScrollContainerAbove(element: HTMLElement) {
+  for (let ancestor = element.parentElement; ancestor; ancestor = ancestor.parentElement) {
+    expect(ancestor.className).not.toMatch(SCROLL_CONTAINER_CLASS);
+  }
+}
+
+describe("AppLayout", () => {
+  it("does not wrap the page content in its own scroll container", () => {
+    render(
+      <AppLayout>
+        <p>Seiteninhalt</p>
+      </AppLayout>,
+    );
+
+    expectNoScrollContainerAbove(screen.getByText("Seiteninhalt"));
+  });
+
+  it("keeps every ancestor of a form's save bar, including the Card, free of scroll containers", () => {
+    render(
+      <AppLayout>
+        <main>
+          <Card className="max-w-lg">
+            <CardContent>
+              <form>
+                <StickySubmit>
+                  <button type="submit">Speichern</button>
+                </StickySubmit>
+              </form>
+            </CardContent>
+          </Card>
+        </main>
+      </AppLayout>,
+    );
+
+    const saveBar = screen.getByRole("button", { name: "Speichern" }).parentElement!;
+    expectNoScrollContainerAbove(saveBar);
+  });
+});