feat: platform backbone and field capture, first part (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), reviewed tasks:
- run roles api/worker/job/all with shared startup checks (Task 1)
- schema and migration for DomainEvent, deliveries, JobRun, ThrottlerHit (Task 2)
- audit, notifications and domain events written in the same transaction (Task 3)
- dispatcher with SKIP LOCKED claims, retries and stale release (Task 4)
- worker building blocks: tick, LISTEN/NOTIFY wake-up, health (Task 5)
- worker process and entry points (Task 6)
- throttler counters in Postgres (Task 19)
- separate keys per purpose with key ring (Task 20)
- public origin page without exact location (Task 22)
- shop keys split into read and write (Task 23)
- Kustomize base, components, overlay encry, CI validation (Task 26)

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), reviewed tasks:
- brood frames, read endpoints, apiary overview and offline pack
- network basics, offline queue v3, navigation sheets, form building blocks
- new inspection with last-time hints and weather, varroa per day,
  treatment prefill, apiary page with round
- inspection photo (Task 10) is implemented, review pending

Not rolled out. Remaining tasks follow in later commits.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

deploy/k8s/overlays/encry/configmap-backend.yaml

@@ -0,0 +1,21 @@
+# Werte fuer den Cluster. Bedeutung der Schluessel:
+# base/backend/configmap.example.yaml. Hosts und Tenant sind Platzhalter,
+# Runbook Schritt 1 uebernimmt die Live-Werte. Geheimes gehoert ins Secret
+# apicore-backend-secret, nie hierher.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: apicore-backend-config
+data:
+  PORT: "3001"
+  JWT_ACCESS_EXPIRES_IN: "15m"
+  JWT_REFRESH_EXPIRES_IN: "7d"
+  FRONTEND_ORIGIN: "https://apicore.example.com"
+  DOCUMENTS_STORAGE_PATH: "/data/documents"
+  BACKUP_STORAGE_PATH: "/data/backups"
+  BACKUP_CRON_SCHEDULE: "0 3 * * *"
+  BACKUP_RETENTION_COUNT: "14"
+  COOKIE_SECURE: "true"
+  TRUST_PROXY: "loopback, 10.42.0.0/16, 173.245.48.0/20, 103.21.244.0/22, 103.22.200.0/22, 103.31.4.0/22, 141.101.64.0/18, 108.162.192.0/18, 190.93.240.0/20, 188.114.96.0/20, 197.234.240.0/22, 198.41.128.0/17, 162.158.0.0/15, 104.16.0.0/13, 104.24.0.0/14, 172.64.0.0/13, 131.0.72.0/22, 2400:cb00::/32, 2606:4700::/32, 2803:f800::/32, 2405:b500::/32, 2405:8100::/32, 2a06:98c0::/29, 2c0f:f248::/32"
+  OIDC_ISSUER_URL: "https://login.microsoftonline.com/<tenant-id>/v2.0"
+  OIDC_REDIRECT_URI: "https://api.apicore.example.com/api/v1/auth/sso/callback"