feat: open the last locked fields for editing, keeping their history intact

Four fields were still frozen because changing them would have bypassed the
record that makes the change traceable, and a user's login data could not be
corrected at all. Locking a field is the wrong trade: a wrong value stays in
the system forever. The fix is to let the edit write the same history entry the
dedicated endpoint writes.

- A colony's apiary is editable through PATCH and writes the same
  ColonyApiaryHistory entry POST /colonies/:id/move writes, so the location
  history never skips a stand the colony was recorded on.
- A honey batch's storage container is editable through PATCH and writes the
  same HoneyBatchRelocation entry POST /honey-batches/:id/relocate writes.
- A stock item's quantity is editable and books the difference as an ADJUSTMENT
  movement, so the stored level stays the sum of its movements.
- A role's key is editable (system roles were already rejected outright by
  RolesService.update, which keeps the seed's ADMIN lookup intact).
- A user's e-mail - the login identity - is editable. A typo there previously
  locked the account out for good.
- New POST /users/:id/reset-password lets an administrator set someone else's
  password: there is no self-service reset flow, so a forgotten password was
  the one thing no edit could repair. It revokes every refresh token and clears
  the permission cache exactly as a self-service change does, refuses to act on
  your own account (that goes through /profile/password, which proves ownership
  by asking for the current one), and never writes the password to the log.

Frontend:
- Users had no edit UI at all, although PATCH /users/:id existed. New
  EditUserDialog covers name, e-mail, role and an optional new password.
- Colony, honey batch and stock item forms gained the newly editable fields,
  each with a note saying the correction is recorded as a move, a relocation
  or a stock adjustment.
- The role dialog gained the key field.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Backend/src/honey-batches/dto/update-honey-batch.dto.ts

@@ -4,10 +4,10 @@ import { HoneyBatchStatus } from '../../../generated/prisma';
 import { CreateHoneyBatchDto } from './create-honey-batch.dto';
 
 /**
- * `storageContainerId` is deliberately absent: moving a batch to another
- * container runs through POST /honey-batches/:id/relocate, which also writes
- * the HoneyBatchRelocation entry. A plain PATCH would move the honey without
- * that record.
+ * `storageContainerId` is editable here too, not only through
+ * POST /honey-batches/:id/relocate: a batch recorded in the wrong container is
+ * a data-entry error and must be correctable. The service writes the same
+ * HoneyBatchRelocation entry the relocate endpoint writes.
  */
 class UpdatableHoneyBatchFieldsDto extends PartialType(
   PickType(CreateHoneyBatchDto, [
@@ -16,6 +16,7 @@ class UpdatableHoneyBatchFieldsDto extends PartialType(
     'honeyType',
     'amount',
     'waterContent',
+    'storageContainerId',
   ] as const),
 ) {}
 

ApiCore-Backend/src/honey-batches/honey-batches.service.spec.ts

@@ -354,4 +354,48 @@ describe('HoneyBatchesService', () => {
       );
     });
   });
+
+  describe('update', () => {
+    beforeEach(() => {
+      prisma.$transaction.mockImplementation(
+        async (
+          callback: (tx: typeof prisma) => Promise<unknown>,
+        ): Promise<unknown> => callback(prisma),
+      );
+    });
+
+    it('records a relocation when an edit corrects the storage container', async () => {
+      prisma.honeyBatch.findUnique.mockResolvedValue({
+        ...honeyBatch,
+        storageContainerId: 'container-1',
+      });
+
+      await service.update(
+        'batch-1',
+        { storageContainerId: 'container-2' },
+        'user-1',
+      );
+
+      expect(prisma.honeyBatchRelocation.create).toHaveBeenCalledWith({
+        data: {
+          honeyBatchId: 'batch-1',
+          fromStorageContainerId: 'container-1',
+          toStorageContainerId: 'container-2',
+          userId: 'user-1',
+          notes: 'Korrektur über Honigcharge bearbeiten',
+        },
+      });
+    });
+
+    it('records no relocation when an edit leaves the container untouched', async () => {
+      prisma.honeyBatch.findUnique.mockResolvedValue({
+        ...honeyBatch,
+        storageContainerId: 'container-1',
+      });
+
+      await service.update('batch-1', { honeyType: 'Waldhonig' }, 'user-1');
+
+      expect(prisma.honeyBatchRelocation.create).not.toHaveBeenCalled();
+    });
+  });
 });

ApiCore-Backend/src/honey-batches/honey-batches.service.ts

@@ -86,9 +86,29 @@ export class HoneyBatchesService {
 
   async update(id: string, dto: UpdateHoneyBatchDto, actingUserId: string) {
     const before = await this.findById(id);
-    await this.prisma.honeyBatch.update({
-      where: { id },
-      data: { ...dto },
+    const movesContainer =
+      dto.storageContainerId !== undefined &&
+      dto.storageContainerId !== before.storageContainerId;
+
+    await this.prisma.$transaction(async (tx) => {
+      await tx.honeyBatch.update({
+        where: { id },
+        data: { ...dto },
+      });
+      // Correcting the container has to leave the same trace a deliberate
+      // relocation does - otherwise the batch's storage history would skip a
+      // container it was recorded in.
+      if (movesContainer) {
+        await tx.honeyBatchRelocation.create({
+          data: {
+            honeyBatchId: id,
+            fromStorageContainerId: before.storageContainerId,
+            toStorageContainerId: dto.storageContainerId!,
+            userId: actingUserId,
+            notes: 'Korrektur über Honigcharge bearbeiten',
+          },
+        });
+      }
     });
     const updated = await this.findById(id);
     await this.auditLog.record({