feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks:
- run roles api/worker/job/all with shared startup checks (Task 1)
- schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2)
- audit, notifications and domain events written in the same transaction (Task 3)
- dispatcher with SKIP LOCKED claims, retries and stale release (Task 4)
- worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5)
- worker process and entry points (Task 6)
- throttler counters in Postgres (Task 19)
- separate keys per purpose with key ring (Task 20)
- public origin page without exact location (Task 22)
- shop keys split into read and write (Task 23)
- Kustomize base, components, overlay encry, CI validation (Task 26)

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks:
- brood frames, read endpoints, apiary overview and offline pack
- network basics, offline queue v3, navigation sheets, form building blocks
- new inspection with last-time hints and weather, varroa per day,
  treatment prefill, apiary page with round
- inspection photo (Task 10) is implemented, review pending

Not rolled out. Remaining tasks follow in later commits.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/app/(app)/sidebar.tsx

@@ -2,151 +2,14 @@
 
 import Link from "next/link";
 import { usePathname } from "next/navigation";
-import {
-  BarChart3,
-  CalendarDays,
-  Crown,
-  Database,
-  Droplet,
-  Factory,
-  Boxes,
-  FileClock,
-  FlaskConical,
-  Hexagon,
-  History,
-  LayoutDashboard,
-  Layers,
-  ListTodo,
-  type LucideIcon,
-  MapPin,
-  Package,
-  Scissors,
-  Search,
-  Snowflake,
-  ShoppingBag,
-  Users,
-  Warehouse,
-  Wrench,
-  Zap,
-} from "lucide-react";
+import { FileClock, Hexagon } from "lucide-react";
 import { cn } from "@/lib/utils";
 import type { AuthUser } from "@/lib/auth/auth-context";
-
-interface NavItem {
-  label: string;
-  href: string;
-  icon: LucideIcon;
-  // Any one of these grants visibility - used for hub pages that fold
-  // together several previously-separate settings pages, each gated by its
-  // own permission.
-  permission?: string | string[];
-}
-
-interface NavGroup {
-  label: string | null;
-  items: NavItem[];
-}
-
-const NAV_GROUPS: NavGroup[] = [
-  {
-    label: null,
-    items: [
-      { label: "Dashboard", href: "/dashboard", icon: LayoutDashboard },
-      { label: "Suche", href: "/search", icon: Search },
-    ],
-  },
-  {
-    label: "Betrieb",
-    items: [
-      { label: "Bienenstände", href: "/apiaries", icon: MapPin },
-      { label: "Völker", href: "/colonies", icon: Layers },
-      { label: "Königinnen", href: "/queens", icon: Crown },
-      {
-        label: "Überwinterung",
-        href: "/winter",
-        icon: Snowflake,
-        permission: "winter-checks:read",
-      },
-    ],
-  },
-  {
-    label: "Arbeit",
-    items: [
-      { label: "Aufgaben", href: "/tasks", icon: ListTodo },
-      { label: "Kalender", href: "/calendar", icon: CalendarDays },
-    ],
-  },
-  {
-    label: "Ernte & Lager",
-    items: [
-      { label: "Ernten", href: "/harvests", icon: Scissors },
-      { label: "Schleuderungen", href: "/extractions", icon: FlaskConical },
-      { label: "Honigchargen", href: "/honey-batches", icon: Droplet },
-      { label: "Abfüllungen", href: "/bottling", icon: Package },
-      {
-        label: "Rohstoffe",
-        href: "/raw-materials",
-        icon: Boxes,
-        permission: "raw-material:read",
-      },
-      {
-        label: "Herstellungschargen",
-        href: "/production-batches",
-        icon: Factory,
-        permission: "production-batch:read",
-      },
-      { label: "Produkte", href: "/products", icon: ShoppingBag },
-      { label: "Lager", href: "/storage", icon: Warehouse },
-      { label: "Inventar", href: "/equipment", icon: Wrench },
-    ],
-  },
-  {
-    label: "Auswertung",
-    items: [{ label: "Statistik", href: "/statistics", icon: BarChart3 }],
-  },
-];
-
-const ADMIN_GROUP: NavGroup = {
-  label: "Verwaltung",
-  items: [
-    {
-      label: "Benutzer & Rollen",
-      href: "/settings/users-roles",
-      icon: Users,
-      permission: ["users:read", "roles:read"],
-    },
-    {
-      label: "Automatisierung",
-      href: "/settings/automation",
-      icon: Zap,
-      permission: [
-        "webhooks:read",
-        "automation:read",
-        "task-templates:read",
-        "label-templates:read",
-        "site-settings:read",
-        "calendar:configure",
-        "api-keys:manage",
-      ],
-    },
-    {
-      label: "Backup",
-      href: "/settings/backup",
-      icon: Database,
-      permission: ["backup:export", "backup:import", "import:execute"],
-    },
-    {
-      label: "Audit-Log",
-      href: "/settings/audit-log",
-      icon: History,
-      permission: "audit:read",
-    },
-  ],
-};
+import { isNavActive, type NavItem, visibleNavGroups } from "./nav-config";
 
 function SidebarLink({ item, pathname }: { item: NavItem; pathname: string }) {
   const Icon = item.icon;
-  const isActive = pathname.startsWith(item.href);
+  const isActive = isNavActive(pathname, item.href);
   return (
     <Link
       href={item.href}
@@ -169,26 +32,9 @@ function SidebarLink({ item, pathname }: { item: NavItem; pathname: string }) {
   );
 }
 
-function hasNavPermission(
-  user: AuthUser,
-  permission: NavItem["permission"],
-): boolean {
-  if (!permission) {
-    return true;
-  }
-  const required = Array.isArray(permission) ? permission : [permission];
-  return required.some((key) => user.permissions.includes(key));
-}
-
 export function Sidebar({ user }: { user: AuthUser }) {
   const pathname = usePathname();
-  const visibleAdminItems = ADMIN_GROUP.items.filter((item) =>
-    hasNavPermission(user, item.permission),
-  );
-  const groups =
-    visibleAdminItems.length > 0
-      ? [...NAV_GROUPS, { ...ADMIN_GROUP, items: visibleAdminItems }]
-      : NAV_GROUPS;
+  const groups = visibleNavGroups(user);
 
   return (
     // The page scrolls on the window; the sidebar stays put beside it and