feat: T4b/T4c wave 9 - phenology reports, autopilot A4-A10, honey ledger, Telegram delivery

- Phenology reports API with corrections and revokes; recompute per
  apiary via PhenologyRecomputeRequested, allowBackward for corrections;
  season changes are announced in the morning digest (changes since the
  previous digest, each once)
- Season autopilot A4-A10 with per-apiary sync (Apiary before Colony
  locks) and WinterCheckRecorded
- Honey batch ledger at runtime: initial amount, BOTTLING bookings,
  manual movements, one gram rounding, untracked bottlings never book
- Telegram delivery: planning, Berlin delivery times incl. DST, quiet
  hours, permission re-check and stale skip at send time, rate limits,
  cleanup of old deliveries
- ARCHITECTURE.md: assumptions 47-50 and updated sections 11.x

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/auth/permissions/permission-resolver.service.spec.ts

@@ -94,6 +94,59 @@ describe('PermissionResolverService', () => {
     expect(prisma.user.findUnique).toHaveBeenCalledTimes(2);
   });
 
+  describe('getFreshPermissions', () => {
+    it('the permission check reads fresh, not the 30 s cache', async () => {
+      prisma.user.findUnique.mockResolvedValueOnce(
+        activeUserWithPermissions('tasks:read'),
+      );
+      await resolver.getPermissions('user-1');
+      // The right is revoked on another replica: this process has no
+      // invalidateUser call, the cache still holds the old set.
+      prisma.user.findUnique.mockResolvedValueOnce(
+        activeUserWithPermissions('colonies:read'),
+      );
+
+      const fresh = await resolver.getFreshPermissions('user-1');
+
+      expect([...fresh]).toEqual(['colonies:read']);
+      expect(prisma.user.findUnique).toHaveBeenCalledTimes(2);
+    });
+
+    it('fills the cache for getPermissions', async () => {
+      prisma.user.findUnique.mockResolvedValue(
+        activeUserWithPermissions('tasks:read'),
+      );
+
+      await resolver.getFreshPermissions('user-1');
+      const cached = await resolver.getPermissions('user-1');
+
+      expect([...cached]).toEqual(['tasks:read']);
+      expect(prisma.user.findUnique).toHaveBeenCalledTimes(1);
+    });
+
+    it('is empty for an inactive user, an inactive role and a missing user', async () => {
+      prisma.user.findUnique.mockResolvedValueOnce({
+        isActive: false,
+        role: {
+          status: 'ACTIVE',
+          permissions: [{ permission: { key: 'tasks:read' } }],
+        },
+      });
+      prisma.user.findUnique.mockResolvedValueOnce({
+        isActive: true,
+        role: {
+          status: 'INACTIVE',
+          permissions: [{ permission: { key: 'tasks:read' } }],
+        },
+      });
+      prisma.user.findUnique.mockResolvedValueOnce(null);
+
+      expect((await resolver.getFreshPermissions('u1')).size).toBe(0);
+      expect((await resolver.getFreshPermissions('u2')).size).toBe(0);
+      expect((await resolver.getFreshPermissions('u3')).size).toBe(0);
+    });
+  });
+
   describe('isTokenValid', () => {
     const nowSeconds = Math.floor(Date.now() / 1000);
 

ApiCore-Backend/src/auth/permissions/permission-resolver.service.ts

@@ -37,6 +37,19 @@ export class PermissionResolverService {
     return entry.permissions;
   }
 
+  /**
+   * The permissions read fresh (one primary-key lookup), never from the
+   * cache, and stored as the cache entry. For a process that does not hear
+   * invalidateUser of the API pods (the worker): a right revoked there must
+   * stop mattering at once, not after the 30 s cache window. Empty for an
+   * inactive user or role.
+   */
+  async getFreshPermissions(userId: string): Promise<ReadonlySet<string>> {
+    const entry = await this.loadEntry(userId);
+    this.cache.set(userId, entry);
+    return entry.permissions;
+  }
+
   /**
    * Always read fresh (one primary-key lookup) and stored as the cache
    * entry the PermissionsGuard then uses: a deactivation, role change or