feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks:
- run roles api/worker/job/all with shared startup checks (Task 1)
- schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2)
- audit, notifications and domain events written in the same transaction (Task 3)
- dispatcher with SKIP LOCKED claims, retries and stale release (Task 4)
- worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5)
- worker process and entry points (Task 6)
- throttler counters in Postgres (Task 19)
- separate keys per purpose with key ring (Task 20)
- public origin page without exact location (Task 22)
- shop keys split into read and write (Task 23)
- Kustomize base, components, overlay encry, CI validation (Task 26)

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks:
- brood frames, read endpoints, apiary overview and offline pack
- network basics, offline queue v3, navigation sheets, form building blocks
- new inspection with last-time hints and weather, varroa per day,
  treatment prefill, apiary page with round
- inspection photo (Task 10) is implemented, review pending

Not rolled out. Remaining tasks follow in later commits.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/runtime/root-module.spec.ts

@@ -0,0 +1,109 @@
+import { forwardRef, Module } from '@nestjs/common';
+import { DiscoveryModule } from '@nestjs/core';
+import { AllInOneModule } from '../all-in-one.module';
+import { AppModule } from '../app.module';
+import { ThrottlerStorageModule } from '../common/throttler/throttler-storage.module';
+import { WorkerModule } from '../worker/worker.module';
+import { WorkerRuntimeModule } from '../worker/worker-runtime.module';
+import { isHttpRole, rootModuleFor } from './root-module';
+
+const importsOf = (module: object): unknown[] =>
+  (Reflect.getMetadata('imports', module) as unknown[] | undefined) ?? [];
+
+/**
+ * Every module class reachable from `root` through imports - including
+ * the imports of dynamic modules (also async ones like
+ * ConfigModule.forRoot) and forwardRef()s.
+ */
+async function reachableModules(root: unknown): Promise<Set<unknown>> {
+  const seen = new Set<unknown>();
+  async function visit(entry: unknown): Promise<void> {
+    const resolved: unknown = await entry;
+    // A circular file import can leave an undefined slot behind.
+    if (typeof resolved !== 'object' && typeof resolved !== 'function') {
+      return;
+    }
+    if (resolved === null) {
+      return;
+    }
+    if ('forwardRef' in resolved) {
+      return visit((resolved as { forwardRef: () => unknown }).forwardRef());
+    }
+    if ('module' in resolved) {
+      const dynamic = resolved as { module: unknown; imports?: unknown[] };
+      await visit(dynamic.module);
+      for (const imported of dynamic.imports ?? []) {
+        await visit(imported);
+      }
+      return;
+    }
+    if (seen.has(resolved)) {
+      return;
+    }
+    seen.add(resolved);
+    for (const imported of importsOf(resolved)) {
+      await visit(imported);
+    }
+  }
+  await visit(root);
+  return seen;
+}
+
+// The API role never starts background loops: only the worker and "all"
+// (local development and tests) load the worker runtime.
+describe('rootModuleFor', () => {
+  it('the api module never imports the worker runtime, not even transitively', async () => {
+    const reachable = await reachableModules(AppModule);
+
+    expect(reachable).not.toContain(WorkerRuntimeModule);
+    // The walk really goes deep: into feature modules and dynamic modules.
+    expect(reachable).toContain(DiscoveryModule);
+    expect(reachable).toContain(ThrottlerStorageModule);
+  });
+
+  it('api starts the API module alone', () => {
+    expect(rootModuleFor('api')).toBe(AppModule);
+  });
+
+  it('all adds the worker runtime to the API', () => {
+    expect(rootModuleFor('all')).toBe(AllInOneModule);
+    expect(importsOf(AllInOneModule)).toEqual([AppModule, WorkerRuntimeModule]);
+  });
+
+  it('the worker runs the runtime without the HTTP API', async () => {
+    const reachable = await reachableModules(WorkerModule);
+
+    expect(reachable).toContain(WorkerRuntimeModule);
+    expect(reachable).not.toContain(AppModule);
+  });
+});
+
+describe('reachableModules', () => {
+  @Module({ imports: [WorkerRuntimeModule] })
+  class InnerModule {}
+
+  @Module({ imports: [forwardRef(() => InnerModule)] })
+  class ViaForwardRefModule {}
+
+  @Module({
+    imports: [Promise.resolve({ module: class {}, imports: [InnerModule] })],
+  })
+  class ViaAsyncDynamicModule {}
+
+  it.each([
+    ['a plain import chain', InnerModule],
+    ['a forwardRef', ViaForwardRefModule],
+    ['the imports of an async dynamic module', ViaAsyncDynamicModule],
+  ])('finds the worker runtime behind %s', async (_case, root) => {
+    expect(await reachableModules(root)).toContain(WorkerRuntimeModule);
+  });
+});
+
+describe('isHttpRole', () => {
+  it('admits exactly the roles dist/main.js starts', () => {
+    expect(isHttpRole('api')).toBe(true);
+    expect(isHttpRole('all')).toBe(true);
+    expect(isHttpRole('worker')).toBe(false);
+    expect(isHttpRole('job')).toBe(false);
+  });
+});