feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks:
- run roles api/worker/job/all with shared startup checks (Task 1)
- schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2)
- audit, notifications and domain events written in the same transaction (Task 3)
- dispatcher with SKIP LOCKED claims, retries and stale release (Task 4)
- worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5)
- worker process and entry points (Task 6)
- throttler counters in Postgres (Task 19)
- separate keys per purpose with key ring (Task 20)
- public origin page without exact location (Task 22)
- shop keys split into read and write (Task 23)
- Kustomize base, components, overlay encry, CI validation (Task 26)

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks:
- brood frames, read endpoints, apiary overview and offline pack
- network basics, offline queue v3, navigation sheets, form building blocks
- new inspection with last-time hints and weather, varroa per day,
  treatment prefill, apiary page with round
- inspection photo (Task 10) is implemented, review pending

Not rolled out. Remaining tasks follow in later commits.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/test/varroa.e2e-spec.ts

@@ -25,6 +25,9 @@ describe('Varroa measurements (e2e)', () => {
   let apiaryId: string;
   let colonyId: string;
   let measurementId: string;
+  let noVarroaRoleId: string;
+  let noVarroaUserId: string;
+  let noVarroaToken: string;
 
   beforeAll(async () => {
     app = await createTestApp();
@@ -64,6 +67,28 @@ describe('Varroa measurements (e2e)', () => {
       },
     });
     colonyId = colony.id;
+
+    const noVarroaRole = await prisma.role.create({
+      data: {
+        key: `NO_VARROA_${Date.now()}`,
+        name: 'Ohne Varroa',
+        permissions: {
+          create: [{ permission: { connect: { key: 'apiaries:read' } } }],
+        },
+      },
+    });
+    noVarroaRoleId = noVarroaRole.id;
+    const noVarroaEmail = `varroa-e2e-novarroa-${Date.now()}@example.com`;
+    const noVarroaUser = await prisma.user.create({
+      data: {
+        email: noVarroaEmail,
+        passwordHash,
+        name: 'Ohne Varroa',
+        role: { connect: { id: noVarroaRoleId } },
+      },
+    });
+    noVarroaUserId = noVarroaUser.id;
+    noVarroaToken = (await login(app, noVarroaEmail, password)).accessToken;
   });
 
   afterAll(async () => {
@@ -71,14 +96,15 @@ describe('Varroa measurements (e2e)', () => {
     await prisma.colony.deleteMany({ where: { id: colonyId } });
     await prisma.apiary.deleteMany({ where: { id: apiaryId } });
     await prisma.refreshToken.deleteMany({
-      where: { userId: { in: [beekeeperId, staffId] } },
+      where: { userId: { in: [beekeeperId, staffId, noVarroaUserId] } },
     });
     await prisma.auditLog.deleteMany({
-      where: { userId: { in: [beekeeperId, staffId] } },
+      where: { userId: { in: [beekeeperId, staffId, noVarroaUserId] } },
     });
     await prisma.user.deleteMany({
-      where: { id: { in: [beekeeperId, staffId] } },
+      where: { id: { in: [beekeeperId, staffId, noVarroaUserId] } },
     });
+    await prisma.role.deleteMany({ where: { id: noVarroaRoleId } });
     await app.close();
   });
 
@@ -137,4 +163,28 @@ describe('Varroa measurements (e2e)', () => {
     const measurements = response.body as VarroaMeasurementBody[];
     expect(measurements.some((entry) => entry.id === measurementId)).toBe(true);
   });
+
+  describe('GET /varroa-measurements/threshold', () => {
+    const thresholdBody = (token: string) =>
+      request(app.getHttpServer())
+        .get('/api/v1/varroa-measurements/threshold')
+        .set('Authorization', `Bearer ${token}`);
+
+    it('returns the threshold shape and is not shadowed by :id', async () => {
+      const response = await thresholdBody(staffToken).expect(200);
+
+      const body = response.body as { thresholdMitesPerDay: number | null };
+      expect(Object.keys(body)).toEqual(['thresholdMitesPerDay']);
+      expect(
+        body.thresholdMitesPerDay === null ||
+          typeof body.thresholdMitesPerDay === 'number',
+      ).toBe(true);
+    });
+
+    // The shared rule is never written here (parallel e2e workers); the
+    // inactive / custom value cases are covered by varroa-threshold.spec.ts.
+
+    it('rejects a role without any varroa permission', () =>
+      thresholdBody(noVarroaToken).expect(403));
+  });
 });