fix: Paket 0 – data integrity, security hardening and field usability

Backend
- Backup covers every Prisma model (bundle v3); a guard test fails for any
  new model that is neither backed up nor explicitly excluded. Unsealed
  bundles may only add rows to 27 legacy master/field tables and never
  overwrite; counters, ledgers, settings, roles etc. need a sealed file.
  Shared import limit BACKUP_MAX_IMPORT_BYTES (default 50 MB, max 256 MB)
  with warnings in log and UI; replaced document files are removed after
  commit.
- Post-commit side effects (automation, calendar sync, webhooks) run via
  runAfterCommit and never turn a committed write into a 500, so retries
  with the same Idempotency-Key no longer create duplicates.
- Calendar outbox is multi-replica safe: per-entry claims with stale
  takeover, revision-based settle, new Graph event only on 404/410,
  transactionId on create, 30 s Graph timeout, URL-encoded ids, GUID
  validation for groupId, "run now" in background and resets FAILED.
- Automation tasks are deduplicated under a row lock on the rule.
- Update DTOs follow one null rule: omitted = unchanged, null clears a
  nullable field, null on a required field is a 400.
- Varroa mites/day is recomputed on correction; withdrawal status is
  checked against the harvest date (?at=), bounded colonyIds; inspection
  create is audited; updates re-enqueue calendar entries.
- Dashboard, statistics and apiary/colony guards treat WEAK, CONSPICUOUS
  and QUEENLESS colonies as living.
- Prisma errors and body-parser errors are logged without query values or
  request bodies.
- Migration 20261012100000_calendar_sync_claims; schema index name aligned
  with the existing database object.

Frontend
- Sticky save bar sticks again (no scroll container ancestors, card uses
  overflow-clip), safe-area insets, scroll-padding, FAB hidden on forms,
  sticky desktop sidebar.
- Inspections record yes / no / not checked instead of silent defaults.
- All living colonies are selectable; shared RecordSelect, EnumSelect,
  ChoiceGroup and TriStateField replace per-page copies; selects show
  names instead of ids; labels point at real controls.
- Emptied optional fields are sent as null (emptyToNull) so every field
  can be cleared; dates default to the local day and are sent via
  toApiDate.
- Harvest withdrawal warning uses the harvest date; backup page warns when
  a backup outgrows the import limit and lists skipped tables.

Build and docs
- Docker builds fail unless lint, typecheck and unit tests pass.
- ARCHITECTURE.md updated (assumptions 9-12, 19-21, section 8) and spec
  docs/superpowers/specs/2026-10-12-plattform-rueckgrat-und-fahrplan-design.md
  for the backbone (api/worker/job roles, domain event outbox) and the
  feature roadmap T3-T7.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/winter-checks/types.ts

@@ -1,3 +1,5 @@
+import type { ColonyStatus } from "@/lib/colonies/types";
+
 export type WinterCheckSeason = "AUTUMN" | "SPRING";
 export type WinterOutcome = "SURVIVED" | "WEAK" | "LOST";
 export type ColonyLossCause = "DEAD_OR_EMPTY" | "QUEEN_PROBLEM" | "NATURAL_DISASTER";
@@ -23,23 +25,25 @@ export interface WinterCheckWithColony extends WinterCheck {
   colony: {
     id: string;
     code: string;
-    status: string;
+    status: ColonyStatus;
     apiaryId: string;
     apiary: { id: string; name: string };
   };
 }
 
+/** `null` clears an optional field on an update, an omitted one stays unchanged. */
 export interface WinterCheckInput {
   colonyId: string;
   season: WinterCheckSeason;
   date: string;
   winterYear?: number;
-  occupiedSeams?: number;
-  feedStockKg?: number;
-  queenPresent?: boolean;
-  outcome?: WinterOutcome;
-  lossCause?: ColonyLossCause;
-  notes?: string;
+  occupiedSeams?: number | null;
+  feedStockKg?: number | null;
+  /** null = not checked; on an update it clears an earlier answer. */
+  queenPresent?: boolean | null;
+  outcome?: WinterOutcome | null;
+  lossCause?: ColonyLossCause | null;
+  notes?: string | null;
   /** With outcome LOST: also mark the colony as deceased. */
   markColonyDeceased?: boolean;
 }

ApiCore-Frontend/src/lib/winter-checks/winter.spec.ts

@@ -25,7 +25,7 @@ function colony(overrides: Partial<Colony>): Colony {
   };
 }
 
-const deadColony = {
+const deadColony: WinterCheckWithColony["colony"] = {
   id: "c1",
   code: "V-01",
   status: "DECEASED",

ApiCore-Frontend/src/lib/winter-checks/winter.ts

@@ -1,8 +1,7 @@
 import type { Colony } from "@/lib/colonies/types";
+import { isLivingColony } from "@/lib/colonies/status";
 import type { WinterCheckWithColony } from "./types";
 
-const TERMINAL_STATUSES = new Set(["DISSOLVED", "SOLD", "DECEASED", "MERGED"]);
-
 /** From July on a date belongs to the winter starting that year. */
 export function winterYearFor(date: Date): number {
   return date.getMonth() >= 6 ? date.getFullYear() : date.getFullYear() - 1;
@@ -38,7 +37,7 @@ export function buildWinterRows(
   const names = new Map(apiaryNames);
   const rows = new Map<string, WinterRow & { apiaryId: string }>();
   for (const colony of colonies) {
-    if (TERMINAL_STATUSES.has(colony.status)) continue;
+    if (!isLivingColony(colony)) continue;
     rows.set(colony.id, {
       colonyId: colony.id,
       code: colony.code,
@@ -53,7 +52,7 @@ export function buildWinterRows(
       colonyId: check.colonyId,
       code: check.colony.code,
       apiaryId: check.colony.apiaryId,
-      isLiving: !TERMINAL_STATUSES.has(check.colony.status),
+      isLiving: isLivingColony(check.colony),
       autumn: null,
       spring: null,
     };