feat: T4 wave 11 – bottling form with article values and confirmation, Telegram in the app

- Bottling form: jar size and best-before from the product with source,
  differs-hints before saving, prefill status, water-content confirmation
  naming the measured value, idempotency key renewed on body change;
  product form gets shelf life (months) and whole-gram jar weight.
- Telegram frontend: link card with step-up dialog, t.me-only deep link,
  status polling, unlink; system Telegram card with receiver/sender state
  and confirmed retry; StepUpDialog shared with the backup import.
- Reauth calls never refresh-and-retry on 401 (no double lockout count);
  German texts for expired session and 429; service worker never caches
  Telegram, notification settings and system responses.
- Telegram backend round 2: shared link removal on every disconnect path,
  lease released on shutdown, connection errors not counted as poison.
- ARCHITECTURE.md §2, §6 (Annahmen 56–58), §10, §11.12, §11.13; TASKS.md T4.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/profile/api.ts

@@ -12,14 +12,14 @@ export function changePassword(currentPassword: string, newPassword: string): Pr
   return apiFetch<void>("/profile/password", {
     method: "POST",
     body: JSON.stringify({ currentPassword, newPassword }),
-  });
+  }, { refreshOn401: false });
 }
 
 export function deactivateAccount(currentPassword: string): Promise<void> {
   return apiFetch<void>("/profile", {
     method: "DELETE",
     body: JSON.stringify({ currentPassword }),
-  });
+  }, { refreshOn401: false });
 }
 
 // Sent as a base64 data: URL in a plain JSON body rather than
@@ -73,12 +73,12 @@ export function confirmMfaEnrollment(
   return apiFetch<void>("/profile/mfa/enroll/confirm", {
     method: "POST",
     body: JSON.stringify({ setupToken, code, currentPassword }),
-  });
+  }, { refreshOn401: false });
 }
 
 export function disableMfa(currentPassword: string, mfaCode: string): Promise<void> {
   return apiFetch<void>("/profile/mfa/disable", {
     method: "POST",
     body: JSON.stringify({ currentPassword, mfaCode }),
-  });
+  }, { refreshOn401: false });
 }