feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks:
- run roles api/worker/job/all with shared startup checks (Task 1)
- schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2)
- audit, notifications and domain events written in the same transaction (Task 3)
- dispatcher with SKIP LOCKED claims, retries and stale release (Task 4)
- worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5)
- worker process and entry points (Task 6)
- throttler counters in Postgres (Task 19)
- separate keys per purpose with key ring (Task 20)
- public origin page without exact location (Task 22)
- shop keys split into read and write (Task 23)
- Kustomize base, components, overlay encry, CI validation (Task 26)

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks:
- brood frames, read endpoints, apiary overview and offline pack
- network basics, offline queue v3, navigation sheets, form building blocks
- new inspection with last-time hints and weather, varroa per day,
  treatment prefill, apiary page with round
- inspection photo (Task 10) is implemented, review pending

Not rolled out. Remaining tasks follow in later commits.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/notifications/notifications.service.ts

@@ -4,7 +4,13 @@ import {
   NotFoundException,
 } from '@nestjs/common';
 import { PrismaService } from '../prisma/prisma.service';
-import { Notification, NotificationPriority } from '../../generated/prisma';
+import { DbClient } from '../prisma/db-client';
+import { PermissionKey } from '../auth/permissions/permission-catalog';
+import {
+  Notification,
+  NotificationPriority,
+  Prisma,
+} from '../../generated/prisma';
 
 export interface CreateNotificationInput {
   userId?: string;
@@ -23,8 +29,42 @@ export interface NotificationFilter {
 export class NotificationsService {
   constructor(private readonly prisma: PrismaService) {}
 
-  async record(input: CreateNotificationInput): Promise<Notification> {
-    return this.prisma.notification.create({ data: { ...input } });
+  async record(
+    input: CreateNotificationInput,
+    tx?: Prisma.TransactionClient,
+  ): Promise<Notification> {
+    const db: DbClient = tx ?? this.prisma;
+    return db.notification.create({ data: { ...input } });
+  }
+
+  /**
+   * One notification per user who may act on it: active account, active
+   * role, permission granted - the same rule the PermissionsGuard applies.
+   * Returns how many were written.
+   */
+  async recordForPermission(
+    permission: PermissionKey,
+    input: Omit<CreateNotificationInput, 'userId'>,
+    tx?: Prisma.TransactionClient,
+  ): Promise<number> {
+    const db: DbClient = tx ?? this.prisma;
+    const recipients = await db.user.findMany({
+      where: {
+        isActive: true,
+        role: {
+          status: 'ACTIVE',
+          permissions: { some: { permission: { key: permission } } },
+        },
+      },
+      select: { id: true },
+    });
+    if (recipients.length === 0) {
+      return 0;
+    }
+    const { count } = await db.notification.createMany({
+      data: recipients.map((recipient) => ({ ...input, userId: recipient.id })),
+    });
+    return count;
   }
 
   async findAll(filter: NotificationFilter = {}): Promise<Notification[]> {