feat: T4b/T4c wave 8 - weather history, phenology, honey chain, Telegram base

- Weather history from Open-Meteo behind an adapter: worker loop
  phenology-weather with backoff, Retry-After, User-Agent, chunked
  writes and forecast-to-archive correction
- Phenology: growing degree sum per DWD, phase from reports, GTS and
  calendar, calibration from previous years, daily job step,
  SeasonService reads the stored state
- Honey chain: prefill for extractions and batches (proposals only),
  plausibility and withdrawal warnings, Extraction lock, chain events
  and batch.created webhook from HoneyBatchRecorded
- Telegram base: schema, NotificationDelivery outbox, hardened bot
  client, startup check without crash, no-network-outside-loops guard
- ARCHITECTURE.md: sections 11.11-11.13, assumptions 42-46, env table

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

deploy/k8s/base/backend/secret.example.yaml

@@ -37,3 +37,20 @@ stringData:
   # "Calendars.ReadWrite" hinzufuegen (Admin-Consent noetig).
   OIDC_CLIENT_ID: "change-me-entra-client-id"
   OIDC_CLIENT_SECRET: "change-me-entra-client-secret"
+  # Optionaler Schluessel der Open-Meteo-API (kommerzieller Tarif). Leer
+  # lassen, solange die freie API genutzt wird; dann wird kein apikey gesendet.
+  OPEN_METEO_API_KEY: ""
+
+# Telegram-Bot-Token (optional) - NICHT in diesem Secret, sondern im eigenen
+# Secret apicore-telegram, das nur der Worker einbindet (Secret mit
+# TELEGRAM_BOT_TOKEN, envFrom/secretKeyRef mit optional: true). Der API-Pod
+# darf es nicht einbinden. Der Inhaber legt den Bot bei BotFather und das
+# Secret selbst an; ohne Token laeuft Telegram nicht, alles andere schon.
+#
+# apiVersion: v1
+# kind: Secret
+# metadata:
+#   name: apicore-telegram
+# type: Opaque
+# stringData:
+#   TELEGRAM_BOT_TOKEN: "<token-from-botfather>"