feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks:
- run roles api/worker/job/all with shared startup checks (Task 1)
- schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2)
- audit, notifications and domain events written in the same transaction (Task 3)
- dispatcher with SKIP LOCKED claims, retries and stale release (Task 4)
- worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5)
- worker process and entry points (Task 6)
- throttler counters in Postgres (Task 19)
- separate keys per purpose with key ring (Task 20)
- public origin page without exact location (Task 22)
- shop keys split into read and write (Task 23)
- Kustomize base, components, overlay encry, CI validation (Task 26)

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks:
- brood frames, read endpoints, apiary overview and offline pack
- network basics, offline queue v3, navigation sheets, form building blocks
- new inspection with last-time hints and weather, varroa per day,
  treatment prefill, apiary page with round
- inspection photo (Task 10) is implemented, review pending

Not rolled out. Remaining tasks follow in later commits.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

deploy/k8s/base/postgres/backup-cronjob.yaml

@@ -0,0 +1,76 @@
+# Tägliche pg_dump-Sicherung der ApiCore-Datenbank auf die Storage Box.
+# Voraussetzung im Cluster: StorageClass smb-backup (SMB 3.1.1 mit seal),
+# legt pro PVC einen Ordner unter Server/Backups/<namespace>/ an.
+# Aufbewahrung: 14 Tage täglich, 8 Wochen sonntags.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: apicore-db-backup
+spec:
+  accessModes: [ReadWriteMany]
+  storageClassName: smb-backup
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-db-backup
+spec:
+  schedule: "5 2 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 1800
+      template:
+        metadata:
+          labels:
+            app: apicore-db-backup
+            db-client: "true"
+        spec:
+          restartPolicy: Never
+          automountServiceAccountToken: false
+          securityContext:
+            runAsUser: 70
+            runAsGroup: 70
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: backup
+              image: postgres:18.6-alpine
+              command:
+                - /bin/sh
+                - -ec
+                - |
+                  stamp=$(date +%Y-%m-%d)
+                  kind=daily; [ "$(date +%u)" = "7" ] && kind=weekly
+                  mkdir -p /backups/daily /backups/weekly
+                  pg_dump -h apicore-postgres -Fc -f /backups/$kind/apicore-$stamp.dump.tmp
+                  mv /backups/$kind/apicore-$stamp.dump.tmp /backups/$kind/apicore-$stamp.dump
+                  find /backups/daily -name '*.dump' -mtime +14 -delete
+                  find /backups/weekly -name '*.dump' -mtime +56 -delete
+                  ls -l /backups/$kind | tail -3
+              env:
+                - name: PGUSER
+                  valueFrom: {secretKeyRef: {name: apicore-postgres-secret, key: POSTGRES_USER}}
+                - name: PGPASSWORD
+                  valueFrom: {secretKeyRef: {name: apicore-postgres-secret, key: POSTGRES_PASSWORD}}
+                - name: PGDATABASE
+                  valueFrom: {secretKeyRef: {name: apicore-postgres-secret, key: POSTGRES_DB}}
+              resources:
+                requests: {cpu: "0", memory: "0"}
+                limits: {memory: 512Mi}
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities: {drop: [ALL]}
+              volumeMounts:
+                - {name: backups, mountPath: /backups}
+          volumes:
+            - name: backups
+              persistentVolumeClaim: {claimName: apicore-db-backup}