fix(erp-export): strict seit format, DB clock for settle window, movement index, one scope per key

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/api-keys/api-keys.service.ts

@@ -104,14 +104,19 @@ export class ApiKeysService {
     dto: CreateApiKeyDto,
     actingUserId: string,
   ): Promise<CreatedApiKey> {
-    // Reading and booking are separate keys: a leaked read key cannot book,
-    // a leaked booking key cannot read. Existing combined keys stay valid.
-    // erp-inventory:read is a read scope too.
+    // One scope per new key: a leaked read key cannot book, a leaked booking
+    // key cannot read, and each connected system gets its own key.
+    // Existing multi-scope keys stay valid (ARCHITECTURE.md, Annahme 14).
     if (combinesReadAndWrite(dto.scopes)) {
       throw new BadRequestException(
         'Lese- und Buchungsrecht bitte als getrennte Schlüssel anlegen',
       );
     }
+    if (new Set(dto.scopes).size > 1) {
+      throw new BadRequestException(
+        'Je Schlüssel nur eine Berechtigung - bitte getrennte Schlüssel anlegen',
+      );
+    }
     // Nobody hands a machine more than they may do themselves.
     const callerPermissions =
       await this.permissionResolver.getPermissions(actingUserId);