feat: T4 wave 11 – bottling form with article values and confirmation, Telegram in the app

- Bottling form: jar size and best-before from the product with source,
  differs-hints before saving, prefill status, water-content confirmation
  naming the measured value, idempotency key renewed on body change;
  product form gets shelf life (months) and whole-gram jar weight.
- Telegram frontend: link card with step-up dialog, t.me-only deep link,
  status polling, unlink; system Telegram card with receiver/sender state
  and confirmed retry; StepUpDialog shared with the backup import.
- Reauth calls never refresh-and-retry on 401 (no double lockout count);
  German texts for expired session and 429; service worker never caches
  Telegram, notification settings and system responses.
- Telegram backend round 2: shared link removal on every disconnect path,
  lease released on shutdown, connection errors not counted as poison.
- ARCHITECTURE.md §2, §6 (Annahmen 56–58), §10, §11.12, §11.13; TASKS.md T4.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/auth/api-client.spec.ts

@@ -144,6 +144,27 @@ describe("api-client token refresh", () => {
     expect(fetchMock.mock.calls.filter(([url]) => String(url).endsWith("/things"))).toHaveLength(1);
   });
 
+  it.each([
+    ["JSON", () => apiFetch("/proof", { method: "POST" }, { refreshOn401: false })],
+    [
+      "form data",
+      () => apiFetchFormData("/proof", new FormData(), { refreshOn401: false }),
+    ],
+  ])("sends %s once and shows the server's message on 401 with refreshOn401: false", async (_name, call) => {
+    const fetchMock = vi.fn<(url: string) => Promise<Response>>(async () =>
+      jsonResponse(401, { message: "Das Passwort ist falsch." }),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    await expect(call()).rejects.toMatchObject({
+      status: 401,
+      message: "Das Passwort ist falsch.",
+    });
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(String(fetchMock.mock.calls[0]?.[0])).not.toContain("/auth/refresh");
+  });
+
   it("takes the token as it is without a handler", async () => {
     stubServer({ accessToken: "fresh" });