feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks:
- run roles api/worker/job/all with shared startup checks (Task 1)
- schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2)
- audit, notifications and domain events written in the same transaction (Task 3)
- dispatcher with SKIP LOCKED claims, retries and stale release (Task 4)
- worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5)
- worker process and entry points (Task 6)
- throttler counters in Postgres (Task 19)
- separate keys per purpose with key ring (Task 20)
- public origin page without exact location (Task 22)
- shop keys split into read and write (Task 23)
- Kustomize base, components, overlay encry, CI validation (Task 26)

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks:
- brood frames, read endpoints, apiary overview and offline pack
- network basics, offline queue v3, navigation sheets, form building blocks
- new inspection with last-time hints and weather, varroa per day,
  treatment prefill, apiary page with round
- inspection photo (Task 10) is implemented, review pending

Not rolled out. Remaining tasks follow in later commits.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/.env.example

@@ -2,8 +2,10 @@
 
 DATABASE_URL="postgresql://user:password@localhost:5432/apicore?schema=public"
 
-# Mindestens 32 Zeichen (server-seitig erzwungen, siehe main.ts) - signiert
-# jedes Access-/MFA-/SSO-Token UND verschluesselt gespeicherte TOTP-Secrets.
+# Mindestens 32 Zeichen (server-seitig erzwungen, siehe
+# src/runtime/startup-checks.ts) - signiert jedes Access-/MFA-/SSO-Token.
+# TOTP- und Webhook-Secrets aus der Zeit vor den eigenen Schluesseln (unten)
+# sind noch damit verschluesselt: erst nach dem rekey-Job rotieren.
 # Erzeugen z.B. mit: openssl rand -hex 32
 JWT_ACCESS_SECRET="change-me-to-a-random-value-at-least-32-characters-long"
 JWT_REFRESH_SECRET="change-me-refresh-secret"
@@ -22,7 +24,7 @@ FRONTEND_ORIGIN="http://localhost:3000"
 # trusted (client IP for rate limits and API-key IP allowlists). "1" for the
 # single K8s ingress; a list such as "loopback, 10.0.0.0/8" also works.
 # Behind Cloudflare + Traefik use "loopback, <pod CIDR>, <Cloudflare ranges>"
-# (see deploy/k8s/backend/configmap.example.yaml); "1" would yield the
+# (see deploy/k8s/base/backend/configmap.example.yaml); "1" would yield the
 # Cloudflare edge IP that many clients share.
 TRUST_PROXY=1
 
@@ -54,11 +56,25 @@ BACKUP_CRON_SCHEDULE="0 3 * * *"
 # Wie viele der neuesten Backup-Dateien behalten werden, aeltere werden nach
 # jedem Lauf geloescht (Standard: 14).
 BACKUP_RETENTION_COUNT=14
-# Backups are encrypted (AES-256-GCM). Without this key they are sealed with a
-# key derived from JWT_ACCESS_SECRET and restore only into this deployment.
-# Set the same value on another deployment to restore there. At least 32
-# characters, e.g. "openssl rand -hex 32". Keep it outside the backup storage.
+
+# Encryption keys, one per purpose (AES-256-GCM, key derived per purpose with
+# HKDF): TOTP secrets, webhook signing secrets, backup files. Required in
+# production: at least 32 characters each, all three different from each
+# other and from JWT_ACCESS_SECRET/JWT_REFRESH_SECRET, e.g.
+# "openssl rand -hex 32". Outside production a missing key falls back to one
+# derived from JWT_ACCESS_SECRET.
+# Rotation: move the old value to <NAME>_PREVIOUS (still opens), set a new
+# <NAME>, run the rekey job, then drop <NAME>_PREVIOUS. Backup files are not
+# resealed: keep BACKUP_ENCRYPTION_KEY_PREVIOUS while older files must restore.
+# Set the same BACKUP_ENCRYPTION_KEY on another deployment to restore its
+# backups there (MFA_/WEBHOOK_ENCRYPTION_KEY too, to keep MFA and webhook
+# secrets). Keep the backup key outside the backup storage.
+# MFA_ENCRYPTION_KEY=""
+# WEBHOOK_ENCRYPTION_KEY=""
 # BACKUP_ENCRYPTION_KEY=""
+# MFA_ENCRYPTION_KEY_PREVIOUS=""
+# WEBHOOK_ENCRYPTION_KEY_PREVIOUS=""
+# BACKUP_ENCRYPTION_KEY_PREVIOUS=""
 
 # Entra ID SSO. Ohne alle vier Werte bleibt SSO deaktiviert
 # (GET /api/v1/auth/sso/status meldet enabled: false, kein Fehler beim Start).
@@ -84,3 +100,11 @@ OIDC_REDIRECT_URI="http://localhost:3001/api/v1/auth/sso/callback"
 # gesamte API-Schema ungeschuetzt (kein JwtAuthGuard) preisgeben wuerde.
 # Nur fuer lokale Entwicklung/Debugging explizit aktivieren.
 ENABLE_SWAGGER=false
+
+# Laufrolle des Prozesses: api (nur HTTP), worker, job (CLI) oder all (API +
+# Worker in einem Prozess, nur fuer lokale Entwicklung und Tests). Ohne Wert
+# gilt der Standard des Einstiegspunkts (main: all, worker: worker, cli: job).
+# In Produktion Pflicht und "all" ist dort verboten.
+# APICORE_ROLE=api
+# Port des Health-Endpunkts des Worker-Prozesses.
+# WORKER_HEALTH_PORT=3002