feat: RBAC Phase 2c - Ernte & Lager auf @RequirePermission umgestellt

Harvests, Extractions, HoneyBatches, Storage, Products, Bottling,
Equipment: @Roles(...) durch @RequirePermission(...) ersetzt,
ungeschuetzte GET-Routen mit :read-Rechten geschlossen. HoneyBatches
behaelt die feine Unterscheidung relocate (auch STAFF) vs.
create/measurements (nur BEEKEEPER+); Storage bekommt konsequent
keine STAFF-Schreibrechte (deckt sich mit dem bisherigen @Roles-Stand).

Verifiziert: tsc, lint, volle e2e-Suite 158/159 gruen (1 getrackter Skip).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

ApiCore-Backend/src/equipment/equipment.controller.ts

@@ -8,8 +8,8 @@ import {
   Query,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { EquipmentCondition, LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { EquipmentCondition } from '../../generated/prisma';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateEquipmentDto } from './dto/create-equipment.dto';
@@ -22,17 +22,19 @@ import { EquipmentService } from './equipment.service';
 export class EquipmentController {
   constructor(private readonly equipmentService: EquipmentService) {}
 
+  @RequirePermission('equipment:read')
   @Get()
   findAll(@Query('condition') condition?: EquipmentCondition) {
     return this.equipmentService.findAll({ condition });
   }
 
+  @RequirePermission('equipment:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.equipmentService.findById(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('equipment:create')
   @Post()
   create(
     @Body() dto: CreateEquipmentDto,
@@ -41,7 +43,7 @@ export class EquipmentController {
     return this.equipmentService.create(dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('equipment:update')
   @Patch(':id')
   update(
     @Param('id') id: string,