fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/treatments/api.spec.ts

@@ -0,0 +1,37 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { apiFetch } from "@/lib/auth/api-client";
+import { fetchWithdrawalStatus } from "./api";
+
+vi.mock("@/lib/auth/api-client", () => ({ apiFetch: vi.fn(async () => []) }));
+
+describe("fetchWithdrawalStatus", () => {
+  beforeEach(() => vi.mocked(apiFetch).mockClear());
+
+  it("asks for the withdrawal windows at the harvest date", async () => {
+    await fetchWithdrawalStatus(["colony-a", "colony-b"], "2026-07-15");
+
+    expect(apiFetch).toHaveBeenCalledWith(
+      "/treatments/withdrawal-status?colonyIds=colony-a%2Ccolony-b&at=2026-07-15",
+    );
+  });
+
+  it("leaves the date to the server when none is given", async () => {
+    await fetchWithdrawalStatus(["colony-a"]);
+
+    expect(apiFetch).toHaveBeenCalledWith("/treatments/withdrawal-status?colonyIds=colony-a");
+  });
+
+  it("keeps a crafted id inside its parameter - it cannot set the date", async () => {
+    await fetchWithdrawalStatus(["x&at=1999-01-01"], "2026-07-15");
+
+    const [path] = vi.mocked(apiFetch).mock.calls[0];
+    const query = new URLSearchParams(String(path).split("?")[1]);
+    expect(query.getAll("at")).toEqual(["2026-07-15"]);
+    expect(query.get("colonyIds")).toBe("x&at=1999-01-01");
+  });
+
+  it("does not call the server without colonies", async () => {
+    await expect(fetchWithdrawalStatus([], "2026-07-15")).resolves.toEqual([]);
+    expect(apiFetch).not.toHaveBeenCalled();
+  });
+});

ApiCore-Frontend/src/lib/treatments/api.ts

@@ -11,15 +11,21 @@ export function fetchColonyTreatments(colonyId: string): Promise<Treatment[]> {
   return apiFetch<Treatment[]>(`/colonies/${encodeURIComponent(colonyId)}/treatments`);
 }
 
+/**
+ * Active withdrawal windows of the given colonies at `at` (a harvest date,
+ * "YYYY-MM-DD"); without `at` the server checks "now". Built with
+ * URLSearchParams so an id can never add or override a query parameter.
+ */
 export function fetchWithdrawalStatus(
   colonyIds: string[],
+  at?: string,
 ): Promise<WithdrawalStatus[]> {
   if (colonyIds.length === 0) {
     return Promise.resolve([]);
   }
-  return apiFetch<WithdrawalStatus[]>(
-    `/treatments/withdrawal-status?colonyIds=${colonyIds.join(",")}`,
-  );
+  const params = new URLSearchParams({ colonyIds: colonyIds.join(",") });
+  if (at) params.set("at", at);
+  return apiFetch<WithdrawalStatus[]>(`/treatments/withdrawal-status?${params.toString()}`);
 }
 
 export function createTreatment(

ApiCore-Frontend/src/lib/treatments/types.ts

@@ -19,41 +19,43 @@ export interface Treatment {
   createdAt: string;
 }
 
+/** Optional fields: `null` or omitted both mean "no value". */
 export interface CreateTreatmentInput {
   colonyId: string;
   date: string;
-  startDate?: string;
-  endDate?: string;
+  startDate?: string | null;
+  endDate?: string | null;
   product: string;
-  activeIngredient?: string;
-  amount?: string;
-  method?: string;
-  reason?: string;
-  batchNumber?: string;
-  notes?: string;
-  withdrawalPeriodDays?: number;
-  supplier?: string;
-  purchaseProof?: string;
-  prescribingVet?: string;
+  activeIngredient?: string | null;
+  amount?: string | null;
+  method?: string | null;
+  reason?: string | null;
+  batchNumber?: string | null;
+  notes?: string | null;
+  withdrawalPeriodDays?: number | null;
+  supplier?: string | null;
+  purchaseProof?: string | null;
+  prescribingVet?: string | null;
 }
 
+/** `null` clears an optional field, an omitted one stays unchanged. */
 export interface UpdateTreatmentInput {
   /** Re-files the treatment under a different colony. */
   colonyId?: string;
   date?: string;
-  startDate?: string;
-  endDate?: string;
+  startDate?: string | null;
+  endDate?: string | null;
   product?: string;
-  activeIngredient?: string;
-  amount?: string;
-  method?: string;
-  reason?: string;
-  batchNumber?: string;
-  notes?: string;
-  withdrawalPeriodDays?: number;
-  supplier?: string;
-  purchaseProof?: string;
-  prescribingVet?: string;
+  activeIngredient?: string | null;
+  amount?: string | null;
+  method?: string | null;
+  reason?: string | null;
+  batchNumber?: string | null;
+  notes?: string | null;
+  withdrawalPeriodDays?: number | null;
+  supplier?: string | null;
+  purchaseProof?: string | null;
+  prescribingVet?: string | null;
 }
 
 export interface WithdrawalStatus {