feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks:
- run roles api/worker/job/all with shared startup checks (Task 1)
- schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2)
- audit, notifications and domain events written in the same transaction (Task 3)
- dispatcher with SKIP LOCKED claims, retries and stale release (Task 4)
- worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5)
- worker process and entry points (Task 6)
- throttler counters in Postgres (Task 19)
- separate keys per purpose with key ring (Task 20)
- public origin page without exact location (Task 22)
- shop keys split into read and write (Task 23)
- Kustomize base, components, overlay encry, CI validation (Task 26)

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks:
- brood frames, read endpoints, apiary overview and offline pack
- network basics, offline queue v3, navigation sheets, form building blocks
- new inspection with last-time hints and weather, varroa per day,
  treatment prefill, apiary page with round
- inspection photo (Task 10) is implemented, review pending

Not rolled out. Remaining tasks follow in later commits.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/test/apiaries.e2e-spec.ts

@@ -10,6 +10,7 @@ interface ApiaryBody {
   id: string;
   status: string;
   notes: string | null;
+  publicLocationLabel: string | null;
 }
 
 describe('Apiaries (e2e)', () => {
@@ -23,6 +24,11 @@ describe('Apiaries (e2e)', () => {
   let beekeeperToken: string;
   let readonlyToken: string;
   let apiaryId: string;
+  const noColonyEmail = `apiaries-e2e-nocolony-${Date.now()}@example.com`;
+  let noColonyRoleId: string;
+  let noColonyUserId: string;
+  let noColonyToken: string;
+  let fieldApiaryId: string;
 
   beforeAll(async () => {
     app = await createTestApp();
@@ -50,9 +56,45 @@ describe('Apiaries (e2e)', () => {
 
     beekeeperToken = (await login(app, beekeeperEmail, password)).accessToken;
     readonlyToken = (await login(app, readonlyEmail, password)).accessToken;
+
+    const apiariesRead = await prisma.permission.findMany({
+      where: { key: 'apiaries:read' },
+    });
+    const noColonyRole = await prisma.role.create({
+      data: {
+        key: `APIARIES_ONLY_${Date.now()}`,
+        name: 'Nur Stände',
+        permissions: {
+          create: apiariesRead.map((permission) => ({
+            permissionId: permission.id,
+          })),
+        },
+      },
+    });
+    noColonyRoleId = noColonyRole.id;
+    const noColonyUser = await prisma.user.create({
+      data: {
+        email: noColonyEmail,
+        passwordHash,
+        name: 'No colonies',
+        roleId: noColonyRoleId,
+      },
+    });
+    noColonyUserId = noColonyUser.id;
+    noColonyToken = (await login(app, noColonyEmail, password)).accessToken;
   });
 
   afterAll(async () => {
+    if (fieldApiaryId) {
+      await prisma.task.deleteMany({
+        where: { title: { startsWith: 'field-e2e-' } },
+      });
+      await prisma.colony.deleteMany({ where: { apiaryId: fieldApiaryId } });
+      await prisma.apiary.delete({ where: { id: fieldApiaryId } });
+    }
+    await prisma.refreshToken.deleteMany({ where: { userId: noColonyUserId } });
+    await prisma.user.delete({ where: { id: noColonyUserId } });
+    await prisma.role.delete({ where: { id: noColonyRoleId } });
     if (apiaryId) {
       await prisma.apiary.delete({ where: { id: apiaryId } });
     }
@@ -128,6 +170,24 @@ describe('Apiaries (e2e)', () => {
       .expect(409);
   });
 
+  it('lets publicLocationLabel be set, changed and cleared with null', async () => {
+    const patch = (body: object) =>
+      request(app.getHttpServer())
+        .patch(`/api/v1/apiaries/${apiaryId}`)
+        .set('Authorization', `Bearer ${beekeeperToken}`)
+        .send(body);
+
+    const set = await patch({ publicLocationLabel: 'Nordhessen' }).expect(200);
+    expect((set.body as ApiaryBody).publicLocationLabel).toBe('Nordhessen');
+    const changed = await patch({ publicLocationLabel: 'Südhessen' }).expect(
+      200,
+    );
+    expect((changed.body as ApiaryBody).publicLocationLabel).toBe('Südhessen');
+    const cleared = await patch({ publicLocationLabel: null }).expect(200);
+    expect((cleared.body as ApiaryBody).publicLocationLabel).toBeNull();
+    await patch({ publicLocationLabel: 'x'.repeat(101) }).expect(400);
+  });
+
   it('refuses to deactivate an apiary that still holds a weak colony', async () => {
     const weakColony = await prisma.colony.create({
       data: {
@@ -146,4 +206,120 @@ describe('Apiaries (e2e)', () => {
       await prisma.colony.delete({ where: { id: weakColony.id } });
     }
   });
+
+  describe('apiary field endpoints', () => {
+    interface OverviewBody {
+      apiaryId: string;
+      rows: { code: string }[];
+    }
+    interface PackBody {
+      version: number;
+      apiary: Record<string, unknown>;
+      tasks: { title: string }[] | null;
+    }
+    const codeSuffix = /-\d+$/;
+
+    beforeAll(async () => {
+      const apiary = await prisma.apiary.create({
+        data: {
+          name: 'Feldstand',
+          location: 'Wiese',
+          latitude: 48.1,
+          longitude: 11.5,
+          address: 'Geheimweg 1',
+          notes: 'geheim',
+        },
+      });
+      fieldApiaryId = apiary.id;
+      const suffix = Date.now();
+      const colonies = await Promise.all(
+        (
+          [
+            ['V-10', 'ACTIVE'],
+            ['V-2', 'WEAK'],
+            ['V-3', 'DISSOLVED'],
+          ] as const
+        ).map(([code, status]) =>
+          prisma.colony.create({
+            data: {
+              code: `${code}-${suffix}`,
+              apiaryId: apiary.id,
+              colonyType: 'PRODUCTION_COLONY',
+              status,
+            },
+          }),
+        ),
+      );
+      await prisma.task.createMany({
+        data: [
+          {
+            title: 'field-e2e-apiary',
+            relatedType: 'APIARY',
+            relatedId: apiary.id,
+          },
+          {
+            title: 'field-e2e-colony',
+            relatedType: 'COLONY',
+            relatedId: colonies[0].id,
+          },
+          {
+            title: 'field-e2e-done',
+            relatedType: 'COLONY',
+            relatedId: colonies[0].id,
+            status: 'DONE',
+          },
+        ],
+      });
+    });
+
+    it('colony-overview lists living colonies only, sorted by code', async () => {
+      const response = await request(app.getHttpServer())
+        .get(`/api/v1/apiaries/${fieldApiaryId}/colony-overview`)
+        .set('Authorization', `Bearer ${beekeeperToken}`)
+        .expect(200);
+      const body = response.body as OverviewBody;
+      expect(body.apiaryId).toBe(fieldApiaryId);
+      expect(body.rows.map((row) => row.code.replace(codeSuffix, ''))).toEqual([
+        'V-2',
+        'V-10',
+      ]);
+    });
+
+    it('offline-pack contains the open tasks of the apiary and its colonies', async () => {
+      const response = await request(app.getHttpServer())
+        .get(`/api/v1/apiaries/${fieldApiaryId}/offline-pack`)
+        .set('Authorization', `Bearer ${beekeeperToken}`)
+        .expect(200);
+      const body = response.body as PackBody;
+      expect(body.version).toBe(1);
+      expect(body.tasks?.map((task) => task.title).sort()).toEqual([
+        'field-e2e-apiary',
+        'field-e2e-colony',
+      ]);
+      expect(Object.keys(body.apiary).sort()).toEqual([
+        'id',
+        'location',
+        'name',
+        'status',
+      ]);
+    });
+
+    it('rejects both endpoints without colonies:read', async () => {
+      for (const path of ['colony-overview', 'offline-pack']) {
+        await request(app.getHttpServer())
+          .get(`/api/v1/apiaries/${fieldApiaryId}/${path}`)
+          .set('Authorization', `Bearer ${noColonyToken}`)
+          .expect(403);
+      }
+    });
+
+    it('answers 404 for an unknown apiary', async () => {
+      for (const path of ['colony-overview', 'offline-pack']) {
+        await request(app.getHttpServer())
+          .get(`/api/v1/apiaries/does-not-exist/${path}`)
+          .set('Authorization', `Bearer ${beekeeperToken}`)
+          .expect(404);
+      }
+    });
+  });
 });