fix(erp-export): strict seit format, DB clock for settle window, movement index, one scope per key

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/test/api-keys.e2e-spec.ts

@@ -103,6 +103,14 @@ describe('API keys (e2e)', () => {
     expect(JSON.stringify(response.body)).toContain('getrennte Schlüssel');
   });
 
+  it('refuses a new key with more than one scope', async () => {
+    const response = await createKey({
+      name: `Two reads ${suffix}`,
+      scopes: ['shop-sync:read', 'erp-inventory:read'],
+    }).expect(400);
+    expect(JSON.stringify(response.body)).toContain('nur eine Berechtigung');
+  });
+
   it('lets a key read exactly what its scopes allow', async () => {
     const { token } = (
       await createKey({ name: `Scope ${suffix}`, scopes: ['shop-sync:read'] })