feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks:
- run roles api/worker/job/all with shared startup checks (Task 1)
- schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2)
- audit, notifications and domain events written in the same transaction (Task 3)
- dispatcher with SKIP LOCKED claims, retries and stale release (Task 4)
- worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5)
- worker process and entry points (Task 6)
- throttler counters in Postgres (Task 19)
- separate keys per purpose with key ring (Task 20)
- public origin page without exact location (Task 22)
- shop keys split into read and write (Task 23)
- Kustomize base, components, overlay encry, CI validation (Task 26)

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks:
- brood frames, read endpoints, apiary overview and offline pack
- network basics, offline queue v3, navigation sheets, form building blocks
- new inspection with last-time hints and weather, varroa per day,
  treatment prefill, apiary page with round
- inspection photo (Task 10) is implemented, review pending

Not rolled out. Remaining tasks follow in later commits.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

deploy/k8s/components/api-hpa/hpa.yaml

@@ -0,0 +1,18 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: apicore-backend
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: apicore-backend
+  minReplicas: 1
+  maxReplicas: 2
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70

deploy/k8s/components/api-hpa/kustomization.yaml

@@ -0,0 +1,16 @@
+# HPA fuer die api: 1-2 Pods bei 70 % CPU (Spec 2026-10-12 Abschnitt 7).
+# Voraussetzungen: CPU-Requests (components/backend-roles) und der Throttler
+# ueber die DB, damit Limits ueber beide Pods zaehlen. Rollout: Runbook Schritt 5.
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+resources:
+  - hpa.yaml
+patches:
+  # Ohne replicas im Deployment setzt ein apply die Pod-Zahl nicht auf 1
+  # zurueck, die der HPA gerade gewaehlt hat.
+  - path: patch-api-replicas.yaml
+    target:
+      group: apps
+      version: v1
+      kind: Deployment
+      name: apicore-backend

deploy/k8s/components/api-hpa/patch-api-replicas.yaml

@@ -0,0 +1,2 @@
+- op: remove
+  path: /spec/replicas

deploy/k8s/components/backend-roles/cronjobs.yaml

@@ -0,0 +1,163 @@
+# job-Rolle: je Job ein CronJob `node dist/cli.js <job>` (Spec 2026-10-12
+# Abschnitt 2). Hier steht nur, was je Job verschieden ist. Zeitzone,
+# Forbid, Aufbewahrung, Image, Umgebung, Haertung und Ressourcen setzt der
+# gemeinsame Patch in kustomization.yaml fuer alle CronJobs mit
+# app=apicore-job.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-job-cleanup
+  labels:
+    app: apicore-job
+    apicore.io/job: cleanup
+spec:
+  schedule: "0 4 * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 1800
+      template:
+        metadata:
+          labels:
+            app: apicore-job
+            apicore.io/job: cleanup
+            db-client: "true"
+        spec:
+          containers:
+            - name: job
+              command: ["node", "dist/cli.js", "cleanup"]
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-job-daily-evaluation
+  labels:
+    app: apicore-job
+    apicore.io/job: daily-evaluation
+spec:
+  schedule: "30 4 * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 1800
+      template:
+        metadata:
+          labels:
+            app: apicore-job
+            apicore.io/job: daily-evaluation
+            db-client: "true"
+        spec:
+          containers:
+            - name: job
+              command: ["node", "dist/cli.js", "daily-evaluation"]
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-job-task-templates
+  labels:
+    app: apicore-job
+    apicore.io/job: task-templates
+spec:
+  schedule: "0 5 * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 1800
+      template:
+        metadata:
+          labels:
+            app: apicore-job
+            apicore.io/job: task-templates
+            db-client: "true"
+        spec:
+          containers:
+            - name: job
+              command: ["node", "dist/cli.js", "task-templates"]
+---
+# Laeuft stuendlich und prueft selbst, ob laut Zeitplan aus GUI oder Env
+# ein Backup faellig ist. Schreibt nach /data/backups (apicore-data) und
+# liest die Dokumente aus /data/documents.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-job-app-backup
+  labels:
+    app: apicore-job
+    apicore.io/job: app-backup
+spec:
+  schedule: "0 * * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 3600
+      template:
+        metadata:
+          labels:
+            app: apicore-job
+            apicore.io/job: app-backup
+            db-client: "true"
+        spec:
+          volumes:
+            - name: data
+              persistentVolumeClaim:
+                claimName: apicore-data
+          containers:
+            - name: job
+              command: ["node", "dist/cli.js", "app-backup"]
+              volumeMounts:
+                - name: data
+                  mountPath: /data
+---
+# rekey und rekey-dry-run laufen nie nach Zeitplan (suspend, 31. Februar),
+# nur von Hand: kubectl create job ... --from=cronjob/apicore-job-rekey
+# (Runbook Schritt 4).
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-job-rekey
+  labels:
+    app: apicore-job
+    apicore.io/job: rekey
+spec:
+  schedule: "0 0 31 2 *"
+  suspend: true
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 1800
+      template:
+        metadata:
+          labels:
+            app: apicore-job
+            apicore.io/job: rekey
+            db-client: "true"
+        spec:
+          containers:
+            - name: job
+              command: ["node", "dist/cli.js", "rekey"]
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-job-rekey-dry-run
+  labels:
+    app: apicore-job
+    apicore.io/job: rekey-dry-run
+spec:
+  schedule: "0 0 31 2 *"
+  suspend: true
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 1800
+      template:
+        metadata:
+          labels:
+            app: apicore-job
+            apicore.io/job: rekey-dry-run
+            db-client: "true"
+        spec:
+          containers:
+            - name: job
+              command: ["node", "dist/cli.js", "rekey", "--dry-run"]

deploy/k8s/components/backend-roles/kustomization.yaml

@@ -0,0 +1,71 @@
+# Laufrollen aus einem Image (Spec 2026-10-12 Abschnitt 2): api (Patch auf
+# apicore-backend), worker (eigenes Deployment) und job (CronJobs).
+# Rollout: Runbook Schritt 3, erst nachdem das Secret die neuen Schluessel hat.
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+resources:
+  - worker-deployment.yaml
+  - cronjobs.yaml
+patches:
+  - path: patch-api.yaml
+  # Gemeinsam fuer alle App-CronJobs; cronjobs.yaml haelt nur, was je Job
+  # verschieden ist. Werte laut Plan 2026-10-13 "Global Constraints".
+  - target:
+      kind: CronJob
+      labelSelector: app=apicore-job
+    patch: |-
+      apiVersion: batch/v1
+      kind: CronJob
+      metadata:
+        name: any-app-job
+      spec:
+        timeZone: Europe/Berlin
+        concurrencyPolicy: Forbid
+        startingDeadlineSeconds: 600
+        successfulJobsHistoryLimit: 3
+        failedJobsHistoryLimit: 3
+        jobTemplate:
+          spec:
+            ttlSecondsAfterFinished: 86400
+            template:
+              spec:
+                restartPolicy: Never
+                automountServiceAccountToken: false
+                securityContext:
+                  runAsNonRoot: true
+                  runAsUser: 1000
+                  runAsGroup: 1000
+                  seccompProfile:
+                    type: RuntimeDefault
+                volumes:
+                  - name: tmp
+                    emptyDir: {}
+                containers:
+                  - name: job
+                    image: git.encry.de/nick.rosenloecher/apicore-backend
+                    imagePullPolicy: IfNotPresent
+                    env:
+                      - name: APICORE_ROLE
+                        value: job
+                      - name: HOME
+                        value: /tmp
+                    envFrom:
+                      - configMapRef:
+                          name: apicore-backend-config
+                      - secretRef:
+                          name: apicore-backend-secret
+                    securityContext:
+                      allowPrivilegeEscalation: false
+                      readOnlyRootFilesystem: true
+                      capabilities:
+                        drop: ["ALL"]
+                    volumeMounts:
+                      - name: tmp
+                        mountPath: /tmp
+                    resources:
+                      requests:
+                        cpu: 50m
+                        memory: 192Mi
+                      limits:
+                        cpu: 500m
+                        memory: 512Mi

deploy/k8s/components/backend-roles/patch-api.yaml

@@ -0,0 +1,91 @@
+# api-Rolle des Backends (Spec 2026-10-12 Abschnitte 2, 5.3 und 7).
+# Migration und Seed laufen als initContainer statt im CMD: scheitert die
+# Migration, startet der neue Pod nicht und der alte laeuft weiter.
+# `migrate deploy` nimmt einen Advisory-Lock in der DB, darum duerfen api und
+# worker gleichzeitig starten. Den Seed fuehrt nur die api aus.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: apicore-backend
+spec:
+  template:
+    # Das Label db-client: "true" setzt components/network-policies, deren
+    # Postgres-Policy es braucht.
+    spec:
+      automountServiceAccountToken: false
+      volumes:
+        - name: tmp
+          emptyDir: {}
+      initContainers:
+        - name: migrate
+          image: git.encry.de/nick.rosenloecher/apicore-backend
+          imagePullPolicy: IfNotPresent
+          command: ["node", "node_modules/prisma/build/index.js", "migrate", "deploy"]
+          env:
+            - name: HOME
+              value: /tmp
+            - name: CHECKPOINT_DISABLE
+              value: "1"
+          envFrom:
+            - configMapRef:
+                name: apicore-backend-config
+            - secretRef:
+                name: apicore-backend-secret
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          resources:
+            requests:
+              cpu: 50m
+              memory: 192Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+        - name: seed
+          image: git.encry.de/nick.rosenloecher/apicore-backend
+          imagePullPolicy: IfNotPresent
+          command: ["node", "dist/seed.js"]
+          envFrom:
+            - configMapRef:
+                name: apicore-backend-config
+            - secretRef:
+                name: apicore-backend-secret
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          resources:
+            requests:
+              cpu: 50m
+              memory: 192Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+      containers:
+        - name: apicore-backend
+          env:
+            - name: APICORE_ROLE
+              value: api
+            - name: HOME
+              value: /tmp
+          securityContext:
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          resources:
+            requests:
+              cpu: 50m
+              memory: 192Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi

deploy/k8s/components/backend-roles/worker-deployment.yaml

@@ -0,0 +1,127 @@
+# worker-Rolle: Event-Dispatcher, Kalender-Outbox und Webhook-Zustellung
+# (Spec 2026-10-12 Abschnitt 2). Kein Service und kein Ingress; Port 3002
+# beantwortet nur /health fuer die Probes. Alle Schleifen arbeiten mit
+# SKIP LOCKED, mehr als ein Replica waere also moeglich.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: apicore-worker
+  labels:
+    app: apicore-worker
+spec:
+  replicas: 1
+  # Wie bei der api: scheitert die Migration, laeuft der alte Worker weiter.
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app: apicore-worker
+  template:
+    metadata:
+      labels:
+        app: apicore-worker
+        db-client: "true"
+    spec:
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: tmp
+          emptyDir: {}
+      initContainers:
+        # Ohne Seed: den fuehrt nur die api aus.
+        - name: migrate
+          image: git.encry.de/nick.rosenloecher/apicore-backend
+          imagePullPolicy: IfNotPresent
+          command: ["node", "node_modules/prisma/build/index.js", "migrate", "deploy"]
+          env:
+            - name: HOME
+              value: /tmp
+            - name: CHECKPOINT_DISABLE
+              value: "1"
+          envFrom:
+            - configMapRef:
+                name: apicore-backend-config
+            - secretRef:
+                name: apicore-backend-secret
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          resources:
+            requests:
+              cpu: 50m
+              memory: 192Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+      containers:
+        - name: apicore-worker
+          image: git.encry.de/nick.rosenloecher/apicore-backend
+          imagePullPolicy: IfNotPresent
+          command: ["node", "dist/worker.js"]
+          env:
+            - name: APICORE_ROLE
+              value: worker
+            - name: WORKER_HEALTH_PORT
+              value: "3002"
+            - name: HOME
+              value: /tmp
+          envFrom:
+            - configMapRef:
+                name: apicore-backend-config
+            - secretRef:
+                name: apicore-backend-secret
+          ports:
+            - name: health
+              containerPort: 3002
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          # /health ist gesund, wenn die DB in hoechstens 5 s antwortet und
+          # der letzte Dispatcher-Durchlauf hoechstens 2 Minuten her ist.
+          # Darum timeoutSeconds 5 statt der Vorgabe von 1 s.
+          startupProbe:
+            httpGet:
+              path: /health
+              port: health
+            failureThreshold: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: health
+            periodSeconds: 30
+            failureThreshold: 3
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: health
+            periodSeconds: 15
+            timeoutSeconds: 5
+          resources:
+            requests:
+              cpu: 20m
+              memory: 128Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi

deploy/k8s/components/network-policies/acme-http01-solver.yaml

@@ -0,0 +1,22 @@
+# cert-manager loest HTTP-01 (ClusterIssuer letsencrypt-prod, Klasse traefik)
+# mit kurzlebigen Solver-Pods in diesem Namespace. Traefik muss sie auf 8089
+# erreichen, sonst scheitert jede Zertifikatserneuerung. Sonst niemand.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: acme-http01-solver
+spec:
+  podSelector:
+    matchLabels:
+      acme.cert-manager.io/http01-solver: "true"
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: rke2-traefik
+      ports:
+        - {protocol: TCP, port: 8089}

deploy/k8s/components/network-policies/allow-dns.yaml

@@ -0,0 +1,19 @@
+# Jeder Pod darf Namen aufloesen, aber nur bei CoreDNS in kube-system.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-dns
+spec:
+  podSelector: {}
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - {protocol: UDP, port: 53}
+        - {protocol: TCP, port: 53}

deploy/k8s/components/network-policies/api.yaml

@@ -0,0 +1,42 @@
+# API: Anfragen von Traefik und vom Frontend. Raus nur zu Postgres und per
+# 443 zu oeffentlichen Adressen (Have I Been Pwned, Open-Meteo, Entra-Login).
+# Canal kennt keine FQDN-Regeln, darum "443 ohne private Bereiche"; den
+# SSRF-Schutz fuer Webhook-Ziele behaelt die App (webhook-url-guard.ts).
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: apicore-api
+spec:
+  podSelector:
+    matchLabels:
+      app: apicore-backend
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: rke2-traefik
+        - podSelector:
+            matchLabels:
+              app: apicore-frontend
+      ports:
+        - {protocol: TCP, port: 3001}
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: apicore-postgres
+      ports:
+        - {protocol: TCP, port: 5432}
+    - to:
+        - ipBlock:
+            cidr: "0.0.0.0/0"
+            except: ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", "169.254.0.0/16", "127.0.0.0/8"]
+        - ipBlock:
+            cidr: "::/0"
+            except: ["fc00::/7", "fe80::/10", "::1/128"]
+      ports:
+        - {protocol: TCP, port: 443}

deploy/k8s/components/network-policies/default-deny.yaml

@@ -0,0 +1,8 @@
+# Alles zu, was keine andere Policy ausdruecklich erlaubt (beide Richtungen).
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+spec:
+  podSelector: {}
+  policyTypes: [Ingress, Egress]

deploy/k8s/components/network-policies/frontend.yaml

@@ -0,0 +1,28 @@
+# Frontend: Anfragen nur von Traefik. Raus nur zum Backend auf 3001, kein
+# Weg zu Postgres und keiner ins Internet.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: apicore-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app: apicore-frontend
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: rke2-traefik
+      ports:
+        - {protocol: TCP, port: 3000}
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app: apicore-backend
+      ports:
+        - {protocol: TCP, port: 3001}

deploy/k8s/components/network-policies/jobs.yaml

@@ -0,0 +1,18 @@
+# CronJob-Pods (App-Jobs und pg_dump): nehmen nichts an, reden nur mit
+# Postgres. Das Backup-Ziel ist ein Volume, kein Netzweg aus dem Pod.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: apicore-jobs
+spec:
+  podSelector:
+    matchExpressions:
+      - {key: app, operator: In, values: [apicore-job, apicore-db-backup]}
+  policyTypes: [Ingress, Egress]
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: apicore-postgres
+      ports:
+        - {protocol: TCP, port: 5432}

deploy/k8s/components/network-policies/kustomization.yaml

@@ -0,0 +1,19 @@
+# NetworkPolicies nach Spec 2026-10-12 Abschnitt 5.2: Default-Deny fuer
+# Ingress und Egress, danach nur die Wege, die jede Rolle braucht.
+# Kubelet-Probes erlaubt Kubernetes immer, sie brauchen keine Regel.
+# Rollout: Runbook Schritt 2 (vorher Selektoren gegen den Live-Stand pruefen).
+# Das Label db-client an der api (patch-api-db-client.yaml) aendert das
+# Pod-Template: die api startet dabei einmal neu.
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+resources:
+  - default-deny.yaml
+  - allow-dns.yaml
+  - frontend.yaml
+  - api.yaml
+  - worker.yaml
+  - jobs.yaml
+  - postgres.yaml
+  - acme-http01-solver.yaml
+patches:
+  - path: patch-api-db-client.yaml

deploy/k8s/components/network-policies/patch-api-db-client.yaml

@@ -0,0 +1,14 @@
+# Die api darf zu Postgres. apicore-postgres laesst nur Pods mit
+# db-client: "true" herein, darum setzt diese Komponente das Label selbst:
+# schon Runbook Schritt 2 (nur NetworkPolicies) braucht es, sonst ist die
+# api von der DB abgeschnitten. Worker, Jobs und pg_dump tragen das Label in
+# ihren eigenen Manifesten.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: apicore-backend
+spec:
+  template:
+    metadata:
+      labels:
+        db-client: "true"

deploy/k8s/components/network-policies/postgres.yaml

@@ -0,0 +1,20 @@
+# Postgres: 5432 nur fuer Pods mit db-client: "true" (api, worker, Jobs,
+# pg_dump) im selben Namespace. Raus nichts ausser DNS (allow-dns).
+# Der Selektor muss zu den Pod-Labels in base/postgres/statefulset.yaml
+# passen; der Test manifest-policy.test.mjs prueft das.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: apicore-postgres
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: apicore-postgres
+  policyTypes: [Ingress, Egress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              db-client: "true"
+      ports:
+        - {protocol: TCP, port: 5432}

deploy/k8s/components/network-policies/worker.yaml

@@ -0,0 +1,27 @@
+# Worker: nimmt nichts an (die Probes kommen vom Kubelet). Raus zu Postgres
+# und per 443 zu oeffentlichen Adressen (Graph, Webhook-Ziele), wie die API.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: apicore-worker
+spec:
+  podSelector:
+    matchLabels:
+      app: apicore-worker
+  policyTypes: [Ingress, Egress]
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: apicore-postgres
+      ports:
+        - {protocol: TCP, port: 5432}
+    - to:
+        - ipBlock:
+            cidr: "0.0.0.0/0"
+            except: ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", "169.254.0.0/16", "127.0.0.0/8"]
+        - ipBlock:
+            cidr: "::/0"
+            except: ["fc00::/7", "fe80::/10", "::1/128"]
+      ports:
+        - {protocol: TCP, port: 443}

deploy/k8s/components/pod-hardening/kustomization.yaml

@@ -0,0 +1,7 @@
+# Pod-Haertung fuer das Frontend nach Spec 2026-10-12 Abschnitte 5.3 und 7.
+# Die Backend-Rollen haerten components/backend-roles mit.
+# Rollout: Runbook Schritt 3.
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+patches:
+  - path: patch-frontend.yaml

deploy/k8s/components/pod-hardening/patch-frontend.yaml

@@ -0,0 +1,31 @@
+# Root-Dateisystem nur lesbar. Schreiben darf Next.js nur in /tmp und in
+# seinen Cache (.next/cache), beides emptyDir.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: apicore-frontend
+spec:
+  template:
+    spec:
+      automountServiceAccountToken: false
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: next-cache
+          emptyDir: {}
+      containers:
+        - name: apicore-frontend
+          securityContext:
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: next-cache
+              mountPath: /app/.next/cache
+          resources:
+            requests:
+              cpu: 30m
+              memory: 128Mi
+            limits:
+              cpu: 300m
+              memory: 256Mi