feat: open the last locked fields for editing, keeping their history intact

Four fields were still frozen because changing them would have bypassed the
record that makes the change traceable, and a user's login data could not be
corrected at all. Locking a field is the wrong trade: a wrong value stays in
the system forever. The fix is to let the edit write the same history entry the
dedicated endpoint writes.

- A colony's apiary is editable through PATCH and writes the same
  ColonyApiaryHistory entry POST /colonies/:id/move writes, so the location
  history never skips a stand the colony was recorded on.
- A honey batch's storage container is editable through PATCH and writes the
  same HoneyBatchRelocation entry POST /honey-batches/:id/relocate writes.
- A stock item's quantity is editable and books the difference as an ADJUSTMENT
  movement, so the stored level stays the sum of its movements.
- A role's key is editable (system roles were already rejected outright by
  RolesService.update, which keeps the seed's ADMIN lookup intact).
- A user's e-mail - the login identity - is editable. A typo there previously
  locked the account out for good.
- New POST /users/:id/reset-password lets an administrator set someone else's
  password: there is no self-service reset flow, so a forgotten password was
  the one thing no edit could repair. It revokes every refresh token and clears
  the permission cache exactly as a self-service change does, refuses to act on
  your own account (that goes through /profile/password, which proves ownership
  by asking for the current one), and never writes the password to the log.

Frontend:
- Users had no edit UI at all, although PATCH /users/:id existed. New
  EditUserDialog covers name, e-mail, role and an optional new password.
- Colony, honey batch and stock item forms gained the newly editable fields,
  each with a note saying the correction is recorded as a move, a relocation
  or a stock adjustment.
- The role dialog gained the key field.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Backend/src/colonies/colonies.service.spec.ts

@@ -336,4 +336,32 @@ describe('ColoniesService', () => {
       expect.objectContaining({ action: 'UPDATE' }),
     );
   });
+
+  it('writes an apiary-history entry when an edit corrects the apiary', async () => {
+    prisma.colony.findUnique.mockResolvedValue(parentColony);
+    tx.colony.update.mockResolvedValue({
+      ...parentColony,
+      apiaryId: 'apiary-2',
+    });
+
+    await service.update('colony-1', { apiaryId: 'apiary-2' }, 'user-1');
+
+    expect(tx.colonyApiaryHistory.create).toHaveBeenCalledWith({
+      data: {
+        colonyId: 'colony-1',
+        apiaryId: 'apiary-2',
+        movedByUserId: 'user-1',
+        notes: 'Korrektur über Volk bearbeiten',
+      },
+    });
+  });
+
+  it('writes no apiary-history entry when an edit leaves the apiary untouched', async () => {
+    prisma.colony.findUnique.mockResolvedValue(parentColony);
+    tx.colony.update.mockResolvedValue(parentColony);
+
+    await service.update('colony-1', { notes: 'geändert' }, 'user-1');
+
+    expect(tx.colonyApiaryHistory.create).not.toHaveBeenCalled();
+  });
 });

ApiCore-Backend/src/colonies/colonies.service.ts

@@ -90,9 +90,31 @@ export class ColoniesService {
     actingUserId: string,
   ): Promise<Colony> {
     const before = await this.findById(id);
-    const colony = await this.prisma.colony.update({
-      where: { id },
-      data: { ...dto },
+    const movesApiary =
+      dto.apiaryId !== undefined && dto.apiaryId !== before.apiaryId;
+    if (movesApiary) {
+      await this.assertApiaryActive(dto.apiaryId!);
+    }
+
+    const colony = await this.prisma.$transaction(async (tx) => {
+      const updated = await tx.colony.update({
+        where: { id },
+        data: { ...dto },
+      });
+      // Correcting the apiary has to leave the same trace a deliberate move
+      // does - otherwise the colony's location history would silently skip a
+      // stand it was recorded on.
+      if (movesApiary) {
+        await tx.colonyApiaryHistory.create({
+          data: {
+            colonyId: id,
+            apiaryId: updated.apiaryId,
+            movedByUserId: actingUserId,
+            notes: 'Korrektur über Volk bearbeiten',
+          },
+        });
+      }
+      return updated;
     });
     await this.auditLog.record({
       entityType: 'Colony',

ApiCore-Backend/src/colonies/dto/update-colony.dto.ts

@@ -4,13 +4,14 @@ import { ColonyStatus } from '../../../generated/prisma';
 import { CreateColonyDto } from './create-colony.dto';
 
 /**
- * `apiaryId` is deliberately absent: moving a colony to another apiary runs
- * through POST /colonies/:id/move, which also writes the ColonyApiaryHistory
- * entry the traceability chain depends on. A plain PATCH would move the
- * colony without that record.
+ * `apiaryId` is editable here too, not only through POST /colonies/:id/move:
+ * a colony recorded on the wrong apiary is a data-entry error and must be
+ * correctable. The service writes the same ColonyApiaryHistory entry the move
+ * endpoint writes, so the traceability chain stays intact either way.
  */
 class UpdatableColonyFieldsDto extends PartialType(
   PickType(CreateColonyDto, [
+    'apiaryId',
     'code',
     'hiveType',
     'originText',