fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/task-templates/labels.ts

@@ -0,0 +1,32 @@
+import { TaskTemplateRecurrenceType } from "./types";
+
+export const RECURRENCE_TYPE_LABELS: Record<TaskTemplateRecurrenceType, string> = {
+  YEARLY: "Jährlich",
+  MONTHLY: "Monatlich",
+  INTERVAL_DAYS: "Alle X Tage",
+};
+
+/** Month of a yearly template as the select holds it: "1" = January. */
+export type Month = "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" | "10" | "11" | "12";
+
+export const MONTH_LABELS: Record<Month, string> = {
+  "1": "Januar",
+  "2": "Februar",
+  "3": "März",
+  "4": "April",
+  "5": "Mai",
+  "6": "Juni",
+  "7": "Juli",
+  "8": "August",
+  "9": "September",
+  "10": "Oktober",
+  "11": "November",
+  "12": "Dezember",
+};
+
+export const MONTHS: Month[] = ["1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12"];
+
+/** The stored month number as a select value; January when none is stored. */
+export function toMonth(month: number | null | undefined): Month {
+  return MONTHS.find((candidate) => candidate === String(month)) ?? "1";
+}

ApiCore-Frontend/src/lib/task-templates/types.ts

@@ -19,22 +19,24 @@ export interface TaskTemplate {
   updatedAt: string;
 }
 
+/** Optional fields: `null` or omitted both mean "no value". */
 export interface CreateTaskTemplateInput {
   title: string;
-  description?: string;
+  description?: string | null;
   priority?: TaskPriority;
-  assignedUserId?: string;
+  assignedUserId?: string | null;
   recurrenceType: TaskTemplateRecurrenceType;
   recurrenceMonth?: number;
   recurrenceDayOfMonth?: number;
   intervalDays?: number;
 }
 
+/** `null` clears an optional field, an omitted one stays unchanged. */
 export interface UpdateTaskTemplateInput {
   title?: string;
-  description?: string;
+  description?: string | null;
   priority?: TaskPriority;
-  assignedUserId?: string;
+  assignedUserId?: string | null;
   recurrenceType?: TaskTemplateRecurrenceType;
   recurrenceMonth?: number;
   recurrenceDayOfMonth?: number;