feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks:
- run roles api/worker/job/all with shared startup checks (Task 1)
- schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2)
- audit, notifications and domain events written in the same transaction (Task 3)
- dispatcher with SKIP LOCKED claims, retries and stale release (Task 4)
- worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5)
- worker process and entry points (Task 6)
- throttler counters in Postgres (Task 19)
- separate keys per purpose with key ring (Task 20)
- public origin page without exact location (Task 22)
- shop keys split into read and write (Task 23)
- Kustomize base, components, overlay encry, CI validation (Task 26)

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks:
- brood frames, read endpoints, apiary overview and offline pack
- network basics, offline queue v3, navigation sheets, form building blocks
- new inspection with last-time hints and weather, varroa per day,
  treatment prefill, apiary page with round
- inspection photo (Task 10) is implemented, review pending

Not rolled out. Remaining tasks follow in later commits.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

deploy/k8s/components/backend-roles/cronjobs.yaml

@@ -0,0 +1,163 @@
+# job-Rolle: je Job ein CronJob `node dist/cli.js <job>` (Spec 2026-10-12
+# Abschnitt 2). Hier steht nur, was je Job verschieden ist. Zeitzone,
+# Forbid, Aufbewahrung, Image, Umgebung, Haertung und Ressourcen setzt der
+# gemeinsame Patch in kustomization.yaml fuer alle CronJobs mit
+# app=apicore-job.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-job-cleanup
+  labels:
+    app: apicore-job
+    apicore.io/job: cleanup
+spec:
+  schedule: "0 4 * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 1800
+      template:
+        metadata:
+          labels:
+            app: apicore-job
+            apicore.io/job: cleanup
+            db-client: "true"
+        spec:
+          containers:
+            - name: job
+              command: ["node", "dist/cli.js", "cleanup"]
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-job-daily-evaluation
+  labels:
+    app: apicore-job
+    apicore.io/job: daily-evaluation
+spec:
+  schedule: "30 4 * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 1800
+      template:
+        metadata:
+          labels:
+            app: apicore-job
+            apicore.io/job: daily-evaluation
+            db-client: "true"
+        spec:
+          containers:
+            - name: job
+              command: ["node", "dist/cli.js", "daily-evaluation"]
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-job-task-templates
+  labels:
+    app: apicore-job
+    apicore.io/job: task-templates
+spec:
+  schedule: "0 5 * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 1800
+      template:
+        metadata:
+          labels:
+            app: apicore-job
+            apicore.io/job: task-templates
+            db-client: "true"
+        spec:
+          containers:
+            - name: job
+              command: ["node", "dist/cli.js", "task-templates"]
+---
+# Laeuft stuendlich und prueft selbst, ob laut Zeitplan aus GUI oder Env
+# ein Backup faellig ist. Schreibt nach /data/backups (apicore-data) und
+# liest die Dokumente aus /data/documents.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-job-app-backup
+  labels:
+    app: apicore-job
+    apicore.io/job: app-backup
+spec:
+  schedule: "0 * * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 3600
+      template:
+        metadata:
+          labels:
+            app: apicore-job
+            apicore.io/job: app-backup
+            db-client: "true"
+        spec:
+          volumes:
+            - name: data
+              persistentVolumeClaim:
+                claimName: apicore-data
+          containers:
+            - name: job
+              command: ["node", "dist/cli.js", "app-backup"]
+              volumeMounts:
+                - name: data
+                  mountPath: /data
+---
+# rekey und rekey-dry-run laufen nie nach Zeitplan (suspend, 31. Februar),
+# nur von Hand: kubectl create job ... --from=cronjob/apicore-job-rekey
+# (Runbook Schritt 4).
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-job-rekey
+  labels:
+    app: apicore-job
+    apicore.io/job: rekey
+spec:
+  schedule: "0 0 31 2 *"
+  suspend: true
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 1800
+      template:
+        metadata:
+          labels:
+            app: apicore-job
+            apicore.io/job: rekey
+            db-client: "true"
+        spec:
+          containers:
+            - name: job
+              command: ["node", "dist/cli.js", "rekey"]
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: apicore-job-rekey-dry-run
+  labels:
+    app: apicore-job
+    apicore.io/job: rekey-dry-run
+spec:
+  schedule: "0 0 31 2 *"
+  suspend: true
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 1800
+      template:
+        metadata:
+          labels:
+            app: apicore-job
+            apicore.io/job: rekey-dry-run
+            db-client: "true"
+        spec:
+          containers:
+            - name: job
+              command: ["node", "dist/cli.js", "rekey", "--dry-run"]