feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks:
- run roles api/worker/job/all with shared startup checks (Task 1)
- schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2)
- audit, notifications and domain events written in the same transaction (Task 3)
- dispatcher with SKIP LOCKED claims, retries and stale release (Task 4)
- worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5)
- worker process and entry points (Task 6)
- throttler counters in Postgres (Task 19)
- separate keys per purpose with key ring (Task 20)
- public origin page without exact location (Task 22)
- shop keys split into read and write (Task 23)
- Kustomize base, components, overlay encry, CI validation (Task 26)

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks:
- brood frames, read endpoints, apiary overview and offline pack
- network basics, offline queue v3, navigation sheets, form building blocks
- new inspection with last-time hints and weather, varroa per day,
  treatment prefill, apiary page with round
- inspection photo (Task 10) is implemented, review pending

Not rolled out. Remaining tasks follow in later commits.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/test/public.e2e-spec.ts

@@ -11,7 +11,7 @@ interface PublicBatchBody {
   productName: string | null;
   honeyType: string | null;
   waterContent: number | null;
-  apiaries: { name: string; location: string | null }[];
+  origin: { regions: string[]; country: string };
   harvestDates: string[];
 }
 
@@ -49,7 +49,14 @@ describe('Public batch origin page (e2e)', () => {
     beekeeperToken = (await login(app, beekeeperEmail, password)).accessToken;
 
     const apiary = await prisma.apiary.create({
-      data: { name: apiaryName, location: 'Wald' },
+      data: {
+        name: apiaryName,
+        location: 'Waldweg 3',
+        address: 'Waldweg 3, 12345 Ort',
+        latitude: 51.2,
+        longitude: 9.4,
+        publicLocationLabel: 'Nordhessen',
+      },
     });
     apiaryId = apiary.id;
     const colony = await prisma.colony.create({
@@ -127,14 +134,32 @@ describe('Public batch origin page (e2e)', () => {
     expect(body.productName).toBe('Sommerhonig 500g');
     expect(body.honeyType).toBe('Sommerhonig');
     expect(body.waterContent).toBe(16.8);
-    expect(body.apiaries).toEqual([{ name: apiaryName, location: 'Wald' }]);
+    expect(body.origin.regions).toEqual(['Nordhessen']);
+    expect(body.origin.country).toEqual(expect.any(String));
     expect(body.harvestDates).toHaveLength(1);
   });
 
-  it('returns 404 for an unknown lot', () => {
-    return request(app.getHttpServer())
-      .get('/api/v1/public/batches/does-not-exist')
-      .expect(404);
+  it('never leaks the apiary name, location, address or coordinates', async () => {
+    const response = await request(app.getHttpServer())
+      .get(`/api/v1/public/batches/${lotNumber}`)
+      .expect(200);
+    const text = JSON.stringify(response.body);
+    for (const secret of [apiaryName, 'Waldweg 3', '51.2', '9.4', 'Ort']) {
+      expect(text).not.toContain(secret);
+    }
+    expect(response.body).not.toHaveProperty('apiaries');
+  });
+
+  it('sends the public cache header on 200 and no-store on 404', async () => {
+    const ok = await request(app.getHttpServer())
+      .get(`/api/v1/public/batches/${lotNumber}`)
+      .expect(200)
+      .expect('Cache-Control', 'public, max-age=300, s-maxage=3600');
+    expect(ok.headers['pragma']).toBeUndefined();
+    await request(app.getHttpServer())
+      .get('/api/v1/public/batches/NONE')
+      .expect(404)
+      .expect('Cache-Control', 'no-store');
   });
 
   it('generates a QR code for the bottling batch that deep-links to the public page', async () => {