feat(frontend): Voelker-Views (Modul 3) + Refresh-Token-Race-Fix

/colonies: Liste; /colonies/new: Anlegeformular mit Bienenstand-/
Volkstyp-Auswahl; /colonies/[id]: Bearbeiten, Aktionen (Umsetzen,
Ableger bilden, Vereinigen, Aufloesen je als Dialog/Button) und
Historie-Anzeige. Aktionen deaktiviert, sobald das Volk nicht mehr
ACTIVE ist (Frontend-Pendant zum neuen Backend-Guard).

Beim Live-Testen im Browser gefunden und behoben:
- Echter Root-Cause fuer den fruehren Session-Abbruch nach Reload: der
  Refresh-Token ist einmalig/rotierend, und React StrictMode ruft den
  Session-Restore-Effect im Dev-Modus doppelt auf. Der vorherige
  AbortController-Fix verhinderte nur, dass der Client die verworfene
  Antwort nutzt - er verhinderte NICHT, dass die zweite Anfrage bereits
  serverseitig verarbeitet wurde, bevor abort() griff. Fix: echtes
  Request-Deduplizieren in refreshRequest() (gemeinsames In-Flight-
  Promise) statt Abbruchversuch - der Standardansatz fuer rotierende
  Refresh-Token.
- Historie-Text beim Vereinigen war fuer die aufnehmende Seite falsch
  ("Entstanden durch Vereinigung" impliziert Neuanlage) - jetzt
  "Anderes Volk eingegliedert".

Nav-Leiste und proxy.ts-Matcher um /colonies erweitert.

9 Vitest-Tests, Lint, Typecheck und Build gruen. Kompletter Flow
(Anlegen, Umsetzen, Ableger bilden, Vereinigen, Aufloesen, Historie)
live im Browser gegen den echten Server verifiziert, inkl. Rollen-
filterung in den Aktions-Dialogen.

ApiCore-Frontend/src/lib/auth/api.ts

@@ -17,11 +17,18 @@ export async function loginRequest(email: string, password: string): Promise<Acc
   return response.json() as Promise<AccessTokenResponse>;
 }
 
-export async function refreshRequest(signal?: AbortSignal): Promise<AccessTokenResponse | null> {
+// The refresh token is single-use and rotates on every call. If two callers
+// (e.g. React StrictMode's dev double-invoke, or two components hitting a 401
+// at once) both call refresh at the same time, the second one always fails
+// because the first already rotated the cookie. Deduplicating into one
+// shared in-flight request makes concurrent callers share the same result
+// instead of racing each other.
+let inFlightRefresh: Promise<AccessTokenResponse | null> | null = null;
+
+async function performRefresh(): Promise<AccessTokenResponse | null> {
   const response = await fetch(`${API_URL}/auth/refresh`, {
     method: 'POST',
     credentials: 'include',
-    signal,
   });
   if (!response.ok) {
     return null;
@@ -29,6 +36,15 @@ export async function refreshRequest(signal?: AbortSignal): Promise<AccessTokenR
   return response.json() as Promise<AccessTokenResponse>;
 }
 
+export function refreshRequest(): Promise<AccessTokenResponse | null> {
+  if (!inFlightRefresh) {
+    inFlightRefresh = performRefresh().finally(() => {
+      inFlightRefresh = null;
+    });
+  }
+  return inFlightRefresh;
+}
+
 export async function logoutRequest(): Promise<void> {
   await fetch(`${API_URL}/auth/logout`, { method: 'POST', credentials: 'include' });
 }

ApiCore-Frontend/src/lib/auth/auth-context.tsx

@@ -34,28 +34,16 @@ export function AuthProvider({ children }: { children: ReactNode }) {
   const [isLoading, setIsLoading] = useState(true);
 
   useEffect(() => {
-    const controller = new AbortController();
-    refreshRequest(controller.signal)
+    refreshRequest()
       .then((result) => {
         if (!result) {
           return;
         }
         setUser(applyAccessToken(result.accessToken));
       })
-      .catch((error: unknown) => {
-        if (error instanceof DOMException && error.name === "AbortError") {
-          return;
-        }
-        throw error;
-      })
       .finally(() => {
-        if (!controller.signal.aborted) {
-          setIsLoading(false);
-        }
+        setIsLoading(false);
       });
-    return () => {
-      controller.abort();
-    };
   }, []);
 
   const login = useCallback(async (email: string, password: string) => {

ApiCore-Frontend/src/lib/colonies/api.ts

@@ -0,0 +1,61 @@
+import { apiFetch } from "@/lib/auth/api-client";
+import {
+  Colony,
+  ColonyHistory,
+  CreateColonyInput,
+  MergeColonyInput,
+  MoveColonyInput,
+  SplitColonyInput,
+  UpdateColonyInput,
+} from "./types";
+
+export function fetchColonies(): Promise<Colony[]> {
+  return apiFetch<Colony[]>("/colonies");
+}
+
+export function fetchColony(id: string): Promise<Colony> {
+  return apiFetch<Colony>(`/colonies/${id}`);
+}
+
+export function fetchColonyHistory(id: string): Promise<ColonyHistory> {
+  return apiFetch<ColonyHistory>(`/colonies/${id}/history`);
+}
+
+export function createColony(input: CreateColonyInput): Promise<Colony> {
+  return apiFetch<Colony>("/colonies", {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+}
+
+export function updateColony(id: string, input: UpdateColonyInput): Promise<Colony> {
+  return apiFetch<Colony>(`/colonies/${id}`, {
+    method: "PATCH",
+    body: JSON.stringify(input),
+  });
+}
+
+export function moveColony(id: string, input: MoveColonyInput): Promise<Colony> {
+  return apiFetch<Colony>(`/colonies/${id}/move`, {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+}
+
+export function splitColony(id: string, input: SplitColonyInput): Promise<Colony> {
+  return apiFetch<Colony>(`/colonies/${id}/split`, {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+}
+
+export function mergeColony(id: string, input: MergeColonyInput): Promise<Colony> {
+  return apiFetch<Colony>(`/colonies/${id}/merge`, {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+}
+
+export function dissolveColony(id: string): Promise<Colony> {
+  return apiFetch<Colony>(`/colonies/${id}/dissolve`, { method: "POST" });
+}

ApiCore-Frontend/src/lib/colonies/types.ts

@@ -0,0 +1,100 @@
+export type ColonyType =
+  | "PRODUCTION_COLONY"
+  | "NUCLEUS_COLONY"
+  | "YOUNG_COLONY"
+  | "CARETAKER_COLONY"
+  | "MATING_NUCLEUS"
+  | "RESERVE_COLONY";
+
+export type ColonyStatus =
+  | "ACTIVE"
+  | "WEAK"
+  | "CONSPICUOUS"
+  | "QUEENLESS"
+  | "DISSOLVED"
+  | "SOLD"
+  | "DECEASED"
+  | "MERGED";
+
+export interface Colony {
+  id: string;
+  code: string;
+  apiaryId: string;
+  hiveType: string | null;
+  originText: string | null;
+  colonyType: ColonyType;
+  status: ColonyStatus;
+  strength: number | null;
+  broodStatus: string | null;
+  feedStatus: string | null;
+  healthStatus: string | null;
+  notes: string | null;
+  currentQueenId: string | null;
+  createdAt: string;
+  updatedAt: string;
+  deactivatedAt: string | null;
+}
+
+export interface CreateColonyInput {
+  code: string;
+  apiaryId: string;
+  colonyType: ColonyType;
+  hiveType?: string;
+  originText?: string;
+  notes?: string;
+}
+
+export interface UpdateColonyInput {
+  hiveType?: string;
+  originText?: string;
+  colonyType?: ColonyType;
+  strength?: number;
+  broodStatus?: string;
+  feedStatus?: string;
+  healthStatus?: string;
+  notes?: string;
+  status?: ColonyStatus;
+}
+
+export interface MoveColonyInput {
+  apiaryId: string;
+  notes?: string;
+}
+
+export interface SplitColonyInput {
+  code: string;
+  colonyType: ColonyType;
+  notes?: string;
+}
+
+export interface MergeColonyInput {
+  mergedColonyIds: string[];
+  notes?: string;
+}
+
+export interface ColonyHistory {
+  apiaryHistory: {
+    id: string;
+    apiaryId: string;
+    movedAt: string;
+    notes: string | null;
+  }[];
+  queenHistory: {
+    id: string;
+    queenId: string;
+    startDate: string;
+    endDate: string | null;
+  }[];
+  lineageAsSource: {
+    id: string;
+    type: "SPLIT" | "MERGE";
+    toColonyId: string;
+    date: string;
+  }[];
+  lineageAsResult: {
+    id: string;
+    type: "SPLIT" | "MERGE";
+    fromColonyId: string;
+    date: string;
+  }[];
+}