feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks:
- run roles api/worker/job/all with shared startup checks (Task 1)
- schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2)
- audit, notifications and domain events written in the same transaction (Task 3)
- dispatcher with SKIP LOCKED claims, retries and stale release (Task 4)
- worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5)
- worker process and entry points (Task 6)
- throttler counters in Postgres (Task 19)
- separate keys per purpose with key ring (Task 20)
- public origin page without exact location (Task 22)
- shop keys split into read and write (Task 23)
- Kustomize base, components, overlay encry, CI validation (Task 26)

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks:
- brood frames, read endpoints, apiary overview and offline pack
- network basics, offline queue v3, navigation sheets, form building blocks
- new inspection with last-time hints and weather, varroa per day,
  treatment prefill, apiary page with round
- inspection photo (Task 10) is implemented, review pending

Not rolled out. Remaining tasks follow in later commits.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/site-settings/dto/update-site-settings.dto.ts

@@ -3,9 +3,12 @@ import {
   IsOptional,
   IsString,
   IsUrl,
+  Matches,
   MaxLength,
+  MinLength,
   ValidateIf,
 } from 'class-validator';
+import { IsOptionalNotNull } from '../../common/validation/is-optional-not-null';
 
 // An empty string clears the link (stored as null); anything else must be a
 // real URL - ValidateIf skips the @IsUrl check only for the empty-string
@@ -52,4 +55,15 @@ export class UpdateSiteSettingsDto {
   @IsString()
   @MaxLength(300)
   holderAddress?: string;
+
+  @ApiPropertyOptional({
+    description: 'Herkunftsland auf der öffentlichen Herkunftsseite',
+  })
+  @IsOptionalNotNull()
+  @IsString()
+  @MinLength(2)
+  @MaxLength(80)
+  // At least two visible characters - the value is trimmed before saving.
+  @Matches(/^\s*\S.*\S\s*$/s)
+  originCountry?: string;
 }

ApiCore-Backend/src/site-settings/site-settings.service.ts

@@ -60,6 +60,7 @@ export class SiteSettingsService {
           dto.holderAddress !== undefined
             ? emptyToNull(dto.holderAddress.trim())
             : undefined,
+        originCountry: dto.originCountry?.trim(),
       },
     });
     await this.auditLog.record({