fix: keep quantities, colony/queen states and tasks consistent under retries

Data-integrity fixes found in a systematic review of ApiCore:

- Bottling booked the honey batch amount from a value read outside the
  transaction and wrote an absolute result back, so two concurrent
  bottlings (double tap, two devices) could both pass the check and one
  deduction was lost. Bookings now use a conditional UPDATE inside the
  transaction; corrections and deletions give amounts back atomically.
- Outgoing stock movements could drive stock below zero; the removal is
  now a conditional decrement that refuses when stock is insufficient.
- Weak, conspicuous and queenless colonies were treated as "not active"
  and could not be moved, split or merged - uniting a queenless colony
  is the textbook merge. Only terminal statuses lock a colony now; merging
  a colony into itself and dissolving twice are rejected.
- Moving a queen to another colony failed on the unique currentQueenId
  because the old colony kept pointing at her. The old colony now releases
  her (and becomes QUEENLESS); a queenless colony receiving a queen becomes
  ACTIVE; dissolved colonies cannot receive a queen.
- Completing a task twice moved completedAt and re-sent the webhook;
  reopening a task kept completedAt. Recurring templates created tasks
  without a due date and caught up missed weeks one stale task at a time.
- Automation rules created a new task and warning on every trigger (every
  stock removal below minimum). Tasks now record their source trigger and
  at most one open task per rule and object exists. The varroa threshold
  (mites per day) is only compared with natural-mite-fall rates, not with
  sample-based counts in another unit.
- New opt-in Idempotency-Key support for record-creating endpoints, so
  the offline queue can retry after a lost response without duplicates.
- Permission catalog sync crashed replicas booting concurrently on a
  fresh database (unique violation); it now uses createMany/skipDuplicates.
- Server-side validation for inspection rating scales (1-5), unique
  colony/harvest lists and net weight <= gross weight.
- Stale e2e expectations updated (permission count, trigger list, real PNG
  fixture for the file-signature check).

Migration is additive only (nullable Task column, new table).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/prisma/schema.prisma

@@ -444,27 +444,33 @@ enum TaskRelatedType {
 }
 
 model Task {
-  id                 String          @id @default(cuid())
-  title              String
-  description        String?
-  priority           TaskPriority    @default(NORMAL)
-  dueDate            DateTime?
-  status             TaskStatus      @default(OPEN)
-  assignedUserId     String?
-  assignedUser       User?           @relation("TaskAssignee", fields: [assignedUserId], references: [id])
-  createdByUserId    String?
-  createdByUser      User?           @relation("TaskCreator", fields: [createdByUserId], references: [id])
-  relatedType        TaskRelatedType @default(GENERAL)
-  relatedId          String?
-  sourceInspectionId String?
-  sourceInspection   Inspection?     @relation(fields: [sourceInspectionId], references: [id])
-  sourceTemplateId   String?
-  sourceTemplate     TaskTemplate?   @relation(fields: [sourceTemplateId], references: [id])
-  createdAt          DateTime        @default(now())
-  completedAt        DateTime?
+  id                      String                 @id @default(cuid())
+  title                   String
+  description             String?
+  priority                TaskPriority           @default(NORMAL)
+  dueDate                 DateTime?
+  status                  TaskStatus             @default(OPEN)
+  assignedUserId          String?
+  assignedUser            User?                  @relation("TaskAssignee", fields: [assignedUserId], references: [id])
+  createdByUserId         String?
+  createdByUser           User?                  @relation("TaskCreator", fields: [createdByUserId], references: [id])
+  relatedType             TaskRelatedType        @default(GENERAL)
+  relatedId               String?
+  sourceInspectionId      String?
+  sourceInspection        Inspection?            @relation(fields: [sourceInspectionId], references: [id])
+  sourceTemplateId        String?
+  sourceTemplate          TaskTemplate?          @relation(fields: [sourceTemplateId], references: [id])
+  // Set when an automation rule created the task (not a person). Keeps an
+  // automatic suggestion distinguishable from a planned task, and lets the
+  // rule see that it already left an open task for the same object instead
+  // of piling up a duplicate on every further trigger.
+  sourceAutomationTrigger AutomationTriggerType?
+  createdAt               DateTime               @default(now())
+  completedAt             DateTime?
 
   @@index([status, dueDate])
   @@index([relatedType, relatedId])
+  @@index([sourceAutomationTrigger, relatedType, relatedId, status])
 }
 
 enum TaskTemplateRecurrenceType {
@@ -1136,6 +1142,37 @@ model CalendarSyncSettings {
 // erneutes Enqueue (z. B. nach einer Aufgaben-Änderung) aktualisiert das
 // bestehende Graph-Event über die gespeicherte graphEventId, statt ein
 // Duplikat anzulegen.
+// ---------------------------------------------------------------------------
+// Idempotenz – schützt Anlege-Anfragen vor doppelter Ausführung, wenn ein
+// Client dieselbe Anfrage wiederholt (Offline-Warteschlange nach verlorener
+// Antwort, Netzabbruch, erneutes Absenden). Der Client schickt pro fachlichem
+// Vorgang einen eindeutigen `Idempotency-Key`; eine Wiederholung bekommt die
+// gespeicherte erste Antwort statt eines zweiten Datensatzes. Siehe
+// src/common/idempotency/idempotency.interceptor.ts.
+// ---------------------------------------------------------------------------
+
+enum IdempotencyStatus {
+  PENDING
+  COMPLETED
+}
+
+model IdempotencyRecord {
+  id           String            @id @default(cuid())
+  userId       String
+  key          String
+  // "POST /api/v1/inspections" - a key reused for a different endpoint is
+  // rejected instead of replaying an unrelated response.
+  scope        String
+  status       IdempotencyStatus @default(PENDING)
+  statusCode   Int?
+  responseBody Json?
+  createdAt    DateTime          @default(now())
+  updatedAt    DateTime          @updatedAt
+
+  @@unique([userId, key])
+  @@index([createdAt])
+}
+
 model CalendarSyncOutboxEntry {
   id           String                 @id @default(cuid())
   sourceType   CalendarSyncSourceType