Merge main checkpoint c01a388 into feat/erp-inventar-export

Brings the ERP inventory export up to date with the platform backbone and
field capture work. Conflicts in ARCHITECTURE.md, the API key service and
the API key settings tab resolved by keeping both sides:
- read and write keys stay separate; erp-inventory:read is read-only and
  cannot be combined with a write scope
- the failed-attempt lockout counts in the shared ThrottlerHit table so it
  holds across API pods
- the UI offers only scopes the user holds and creates one scope per key

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/api-keys/scopes.ts

@@ -0,0 +1,30 @@
+import type { ApiKey } from "./types";
+
+/** Berechtigungen, die ein API-Schlüssel tragen kann - wie API_KEY_SCOPES im Backend. */
+export const API_KEY_SCOPES = ["shop-sync:read", "shop-sync:write", "erp-inventory:read"] as const;
+
+export type ApiKeyScope = (typeof API_KEY_SCOPES)[number];
+
+export const API_KEY_SCOPE_LABELS: Record<ApiKeyScope, string> = {
+  "shop-sync:read": "Shop-Daten lesen (Wabenhain)",
+  "shop-sync:write": "Verkäufe und Rückbuchungen buchen (Wabenhain)",
+  "erp-inventory:read": "Inventar-Spiegel lesen (ERPNext)",
+};
+
+/** Buchende Rechte - wie API_KEY_WRITE_SCOPES im Backend; alle anderen lesen nur. */
+const WRITE_SCOPES: readonly string[] = ["shop-sync:write"];
+
+/** Label für die Anzeige; unbekannte Rechte (neueres Backend) unverändert. */
+export function apiKeyScopeLabel(scope: string): string {
+  return (API_KEY_SCOPE_LABELS as Record<string, string>)[scope] ?? scope;
+}
+
+/**
+ * Keys issued before reading and booking were split may still carry both;
+ * the server no longer creates such keys, the UI nudges towards two keys.
+ * The ERP inventory scope counts as reading.
+ */
+export function hasReadAndWriteScopes(apiKey: Pick<ApiKey, "scopes">): boolean {
+  const isWrite = (scope: string) => WRITE_SCOPES.includes(scope);
+  return apiKey.scopes.some(isWrite) && apiKey.scopes.some((scope) => !isWrite(scope));
+}