fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/components/task-related-field.tsx

@@ -12,13 +12,8 @@ import { fetchHoneyBatches } from "@/lib/honey-batches/api";
 import { fetchQueens } from "@/lib/queens/api";
 import { fetchStorageContainers } from "@/lib/storage/api";
 import { Label } from "@/components/ui/label";
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@/components/ui/select";
+import { EnumSelect } from "@/components/form/enum-select";
+import { RecordSelect } from "@/components/form/record-select";
 
 interface RelatedOption {
   id: string;
@@ -98,54 +93,47 @@ export function TaskRelatedField({
     })),
     GENERAL: [],
   };
-  const options = optionsByType[relatedType];
+  const isLoadedByType: Record<TaskRelatedType, boolean> = {
+    COLONY: colonies.data !== undefined,
+    APIARY: apiaries.data !== undefined,
+    QUEEN: queens.data !== undefined,
+    HONEY_BATCH: honeyBatches.data !== undefined,
+    STORAGE: containers.data !== undefined,
+    GENERAL: true,
+  };
+  // undefined while loading, so the select says so instead of guessing.
+  const options = isLoadedByType[relatedType] ? optionsByType[relatedType] : undefined;
 
   return (
     <>
       <div className="flex flex-col gap-2">
         <Label htmlFor={`${idPrefix}-type`}>Bezug</Label>
-        <Select
+        <EnumSelect
+          id={`${idPrefix}-type`}
           value={relatedType}
-          onValueChange={(value) => {
-            const next = (value ?? relatedType) as TaskRelatedType;
+          onChange={(next) => {
             onRelatedTypeChange(next);
             // The old id belongs to the old type's records, so it would point
             // at nothing after the switch.
             onRelatedIdChange("");
           }}
-        >
-          <SelectTrigger id={`${idPrefix}-type`} className="w-full">
-            <SelectValue>{TASK_RELATED_TYPE_LABELS[relatedType]}</SelectValue>
-          </SelectTrigger>
-          <SelectContent>
-            {TASK_RELATED_TYPES.map((option) => (
-              <SelectItem key={option} value={option}>
-                {TASK_RELATED_TYPE_LABELS[option]}
-              </SelectItem>
-            ))}
-          </SelectContent>
-        </Select>
+          values={TASK_RELATED_TYPES}
+          labels={TASK_RELATED_TYPE_LABELS}
+        />
       </div>
       {relatedType === "GENERAL" ? null : (
         <div className="flex flex-col gap-2">
           <Label htmlFor={`${idPrefix}-record`}>
             {TASK_RELATED_TYPE_LABELS[relatedType]}
           </Label>
-          <Select
+          <RecordSelect
+            id={`${idPrefix}-record`}
             value={relatedId}
-            onValueChange={(value) => onRelatedIdChange(value ?? relatedId)}
-          >
-            <SelectTrigger id={`${idPrefix}-record`} className="w-full">
-              <SelectValue placeholder="Datensatz wählen" />
-            </SelectTrigger>
-            <SelectContent>
-              {options.map((option) => (
-                <SelectItem key={option.id} value={option.id}>
-                  {option.label}
-                </SelectItem>
-              ))}
-            </SelectContent>
-          </Select>
+            onChange={onRelatedIdChange}
+            items={options}
+            getLabel={(option) => option.label}
+            placeholder="Datensatz wählen"
+          />
         </div>
       )}
     </>