fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/offline/null-roundtrip.spec.ts

@@ -0,0 +1,100 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { apiFetch } from "@/lib/auth/api-client";
+import {
+  initialInspectionValues,
+  toInspectionInput,
+} from "@/app/(app)/inspections/new/inspection-form-values";
+import { initialVarroaValues, toVarroaInput } from "@/app/(app)/varroa/new/varroa-form-values";
+import {
+  initialFeedingValues,
+  toFeedingInput,
+} from "@/app/(app)/feedings/new/feeding-form-values";
+import {
+  initialTreatmentValues,
+  toTreatmentInput,
+} from "@/app/(app)/treatments/new/treatment-form-values";
+import { queueFeeding, queueInspection, queueTreatment, queueVarroaMeasurement } from "./db";
+import { syncPendingInspections } from "./sync";
+
+/**
+ * Stand-in for IndexedDB that stores entries the way the browser does - as a
+ * structured clone - so the test covers what really survives the queue.
+ */
+vi.mock("idb", () => {
+  const stores = new Map<string, Map<number, unknown>>();
+  let nextId = 1;
+  const db = {
+    add: async (store: string, value: object) => {
+      const id = nextId++;
+      const entries = stores.get(store) ?? new Map<number, unknown>();
+      entries.set(id, structuredClone({ ...value, id }));
+      stores.set(store, entries);
+      return id;
+    },
+    getAll: async (store: string) =>
+      [...(stores.get(store)?.values() ?? [])].map((entry) => structuredClone(entry)),
+    delete: async (store: string, id: number) => {
+      stores.get(store)?.delete(id);
+    },
+    count: async (store: string) => stores.get(store)?.size ?? 0,
+  };
+  return { openDB: vi.fn(async () => db) };
+});
+
+vi.mock("@/lib/auth/api-client", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/lib/auth/api-client")>()),
+  apiFetch: vi.fn(async () => ({ id: "saved" })),
+}));
+
+function sentBody(path: string): Record<string, unknown> {
+  const call = vi.mocked(apiFetch).mock.calls.find(([calledPath]) => calledPath === path);
+  expect(call, `request to ${path}`).toBeDefined();
+  return JSON.parse(String(call?.[1]?.body));
+}
+
+/** What the server receives when the record is sent directly (online). */
+function asSentOnline(input: object): Record<string, unknown> {
+  return JSON.parse(JSON.stringify(input));
+}
+
+describe("offline queue keeps 'not filled in' as null from form to server", () => {
+  beforeEach(() => vi.mocked(apiFetch).mockClear());
+
+  it("replays queued records exactly as they would have been sent online", async () => {
+    const inspection = toInspectionInput({
+      ...initialInspectionValues("colony-1"),
+      eggsPresent: false,
+    });
+    const varroa = toVarroaInput({ ...initialVarroaValues("colony-1"), miteCount: "0" });
+    const feeding = toFeedingInput({ ...initialFeedingValues("colony-1"), amount: "2" });
+    const treatment = toTreatmentInput({
+      ...initialTreatmentValues("colony-1"),
+      product: "Oxuvar",
+    });
+
+    await queueInspection(inspection, "key-inspection");
+    await queueVarroaMeasurement(varroa, "key-varroa");
+    await queueFeeding(feeding, "key-feeding");
+    await queueTreatment(treatment, "key-treatment");
+    const result = await syncPendingInspections();
+
+    expect(result).toEqual({ synced: 4, failed: 0 });
+    expect(sentBody("/inspections")).toEqual(asSentOnline(inspection));
+    expect(sentBody("/varroa-measurements")).toEqual(asSentOnline(varroa));
+    expect(sentBody("/feedings")).toEqual(asSentOnline(feeding));
+    expect(sentBody("/treatments")).toEqual(asSentOnline(treatment));
+  });
+
+  it("sends an untouched inspection observation as null, never as a finding", async () => {
+    await queueInspection(toInspectionInput(initialInspectionValues("colony-1")), "key-2");
+    await syncPendingInspections();
+
+    expect(sentBody("/inspections")).toMatchObject({
+      queenSeen: null,
+      eggsPresent: null,
+      feedStatus: null,
+      weather: null,
+      gentleness: null,
+    });
+  });
+});