fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/backup/import-summary.spec.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+import { unsealedImportWarning } from "./import-summary";
+
+describe("unsealedImportWarning", () => {
+  it("says nothing about a sealed import", () => {
+    expect(unsealedImportWarning({ imported: { apiary: 1 }, skipped: [], sealed: true })).toBeNull();
+  });
+
+  it("lists every table an unsealed file could not restore by its German name", () => {
+    const message = unsealedImportWarning({
+      imported: { apiary: 1 },
+      skipped: ["role", "batchMovement", "calendarSyncSettings", "backupSettings", "document"],
+      sealed: false,
+    });
+
+    expect(message).toContain("Rollen");
+    expect(message).toContain("Bewegungsbuch der Chargen");
+    expect(message).toContain("Kalender-Einstellungen");
+    expect(message).toContain("Backup-Einstellungen");
+    expect(message).toContain("Dokumente");
+  });
+
+  it("explains that existing records were left alone, even with nothing skipped", () => {
+    const message = unsealedImportWarning({ imported: { apiary: 1 }, skipped: [], sealed: false });
+
+    expect(message).toContain("nicht überschrieben");
+    expect(message).not.toContain("Nicht übernommen");
+  });
+
+  it("names a table it has no label for by its key", () => {
+    expect(
+      unsealedImportWarning({ imported: {}, skipped: ["futureTable"], sealed: false }),
+    ).toContain("futureTable");
+  });
+});

ApiCore-Frontend/src/lib/backup/import-summary.ts

@@ -0,0 +1,45 @@
+import { BackupImportSummary } from "./types";
+
+// Every table an unsealed backup may not write (backend: everything outside
+// LEGACY_UNSEALED_TABLES in backup.service.ts).
+const SKIPPED_TABLE_LABELS: Record<string, string> = {
+  role: "Rollen",
+  user: "Benutzer",
+  rolePermission: "Rollenrechte",
+  webhookSubscription: "Webhooks",
+  auditLog: "Audit-Log",
+  automationRule: "Automatisierungen",
+  automationSequence: "Nummernkreise",
+  stockItem: "Lagerartikel",
+  stockMovement: "Lagerbewegungen",
+  batchMovement: "Bewegungsbuch der Chargen",
+  shopStockRequest: "Shop-Buchungen",
+  rawMaterialLot: "Rohstoff-Chargen",
+  productionBatch: "Herstellungschargen",
+  productionInput: "Rohstoffverbrauch",
+  honeyBatchContainerAllocation: "Behälter-Aufteilungen",
+  siteSettings: "Website-Einstellungen",
+  backupSettings: "Backup-Einstellungen",
+  calendarSyncSettings: "Kalender-Einstellungen",
+  calendarSyncOutboxEntry: "Kalender-Synchronisation",
+  document: "Dokumente",
+  notification: "Benachrichtigungen",
+};
+
+/**
+ * What an old, unencrypted backup left out - null for a sealed one. Such a
+ * file only adds missing master and field records and never overwrites
+ * existing ones; everything else it carried is listed by name.
+ */
+export function unsealedImportWarning(summary: BackupImportSummary): string | null {
+  if (summary.sealed !== false && summary.skipped.length === 0) {
+    return null;
+  }
+  const intro =
+    "Altes, unverschlüsseltes Backup: nur fehlende Stammdaten und Aufzeichnungen ergänzt, bestehende Datensätze nicht überschrieben.";
+  if (summary.skipped.length === 0) {
+    return intro;
+  }
+  const labels = summary.skipped.map((table) => SKIPPED_TABLE_LABELS[table] ?? table);
+  return `${intro} Nicht übernommen: ${labels.join(", ")}.`;
+}

ApiCore-Frontend/src/lib/backup/types.ts

@@ -1,7 +1,9 @@
 export interface BackupImportSummary {
   imported: Record<string, number>;
-  /** Tables an old, unencrypted backup may not restore (users, roles, webhooks, audit log). */
+  /** Tables the file carried that an old, unencrypted backup may not restore. */
   skipped: string[];
+  /** False for an old, unencrypted backup: it only added missing records. */
+  sealed: boolean;
 }
 
 export interface BackupScheduleStatus {
@@ -10,6 +12,12 @@ export interface BackupScheduleStatus {
   cronSchedule: string | null;
   retentionCount: number | null;
   lastRunAt: string | null;
+  /** Largest backup file the import accepts (BACKUP_MAX_IMPORT_BYTES). */
+  importLimitBytes: number;
+  /** Size of the newest automatic backup file, null while there is none. */
+  lastBackupSizeBytes: number | null;
+  /** That file could not be restored without a raised import limit. */
+  lastBackupExceedsImportLimit: boolean;
   envOverrides: {
     storagePath: boolean;
     cronSchedule: boolean;