feat: T6 wave 1 – compliance schema, permissions, lock order, backup

- Migrations (additive): veterinary medicines with lots and movement
  ledger, treatment medicine/lot/dose links, label particulars, authority
  notices, apiary restrictions, compliance settings and acknowledgements;
  notification category COMPLIANCE, added to non-empty Telegram lists.
- Permissions veterinary-medicines:* and compliance:* with role grants.
- LOCKABLE_TABLES: Apiary locks before Colony; T6 tables appended.
- Backup exports and restores the new tables in FK order; unsealed files
  skip them and report dropped medicine links; an open TSK draft in the
  target wins.
- describeNullContracts shared helper; Telegram backlog e2e no longer
  depends on the time of day.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/auth/permissions/permission-catalog.ts

@@ -391,6 +391,27 @@ export const PERMISSION_CATALOG = [
     [['read', 'Inventar-Spiegel für ERPNext lesen']],
     3600,
   ),
+  // T6: the veterinary medicine catalogue and its packs. Receipts, invoice
+  // numbers and supplier addresses live here, so the shop account gets none.
+  ...group(
+    'Tierarzneimittel',
+    'veterinary-medicines',
+    [
+      ['read', 'Ansehen'],
+      ['create', 'Anlegen'],
+      ['update', 'Bearbeiten'],
+    ],
+    3700,
+  ),
+  ...group(
+    'Prüfbereitschaft & Behörden',
+    'compliance',
+    [
+      ['read', 'Ansehen'],
+      ['manage', 'Verwalten'],
+    ],
+    3800,
+  ),
 ] as const satisfies readonly PermissionCatalogEntry[];
 
 export type PermissionKey = (typeof PERMISSION_CATALOG)[number]['key'];