feat: T4b/T4c wave 8 - weather history, phenology, honey chain, Telegram base

- Weather history from Open-Meteo behind an adapter: worker loop
  phenology-weather with backoff, Retry-After, User-Agent, chunked
  writes and forecast-to-archive correction
- Phenology: growing degree sum per DWD, phase from reports, GTS and
  calendar, calibration from previous years, daily job step,
  SeasonService reads the stored state
- Honey chain: prefill for extractions and batches (proposals only),
  plausibility and withdrawal warnings, Extraction lock, chain events
  and batch.created webhook from HoneyBatchRecorded
- Telegram base: schema, NotificationDelivery outbox, hardened bot
  client, startup check without crash, no-network-outside-loops guard
- ARCHITECTURE.md: sections 11.11-11.13, assumptions 42-46, env table

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

deploy/k8s/base/backend/configmap.example.yaml

@@ -33,3 +33,18 @@ data:
   # bleibt SSO deaktiviert, /auth/sso/status meldet dann enabled: false.
   OIDC_ISSUER_URL: "https://login.microsoftonline.com/<tenant-id>/v2.0"
   OIDC_REDIRECT_URI: "https://api.apicore.example.com/api/v1/auth/sso/callback"
+  # Wetterquelle (Pflanzenentwicklung, Wetteranzeige). Nur die freie
+  # Open-Meteo-API; nur https:-URLs, ein unbekannter Quellenname oder eine
+  # http:-URL stoppt den Start. Standardwerte gelten ohne Eintrag. Der
+  # optionale Schluessel OPEN_METEO_API_KEY steht im Secret.
+  WEATHER_HISTORY_SOURCE: "open-meteo"
+  OPEN_METEO_FORECAST_URL: "https://api.open-meteo.com/v1/forecast"
+  OPEN_METEO_ARCHIVE_URL: "https://archive-api.open-meteo.com/v1/archive"
+  # Optional: Kontakt (E-Mail oder URL) im User-Agent der Wetteranfragen,
+  # "ApiCore/<Version> (+<Kontakt>)". Ohne Wert: "(self-hosted beekeeping app)".
+  # WEATHER_USER_AGENT_CONTACT: ""
+  # Telegram-Erinnerungen (optional). Name des Bots ohne @ (5-32 Zeichen:
+  # Buchstaben, Ziffern, Unterstrich) fuer den Deep Link; API und Worker lesen
+  # ihn aus dieser ConfigMap. Das Token steht NICHT hier, siehe Kommentar in
+  # secret.example.yaml (Secret apicore-telegram, nur Worker).
+  # TELEGRAM_BOT_USERNAME: "<bot-username>"