feat: RBAC Phase 2b - Betrieb auf @RequirePermission umgestellt

Varroa, SwarmControl, Treatments, Feedings (+ jeweilige
Colony-Sub-Controller): @Roles(...) durch @RequirePermission(...)
ersetzt, ungeschuetzte GET-Routen mit :read-Rechten geschlossen.

Verifiziert: tsc, lint, e2e (varroa/swarm-control/treatments/feedings
einzeln gruen; volle Suite 158/159 gruen, 1 getrackter Skip).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

ApiCore-Backend/src/treatments/treatments.controller.ts

@@ -1,7 +1,6 @@
 import { Body, Controller, Get, Param, Patch, Post } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import { LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateTreatmentDto } from './dto/create-treatment.dto';
@@ -14,17 +13,19 @@ import { TreatmentsService } from './treatments.service';
 export class TreatmentsController {
   constructor(private readonly treatmentsService: TreatmentsService) {}
 
+  @RequirePermission('treatments:read')
   @Get()
   findAll() {
     return this.treatmentsService.findAll();
   }
 
+  @RequirePermission('treatments:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.treatmentsService.findById(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('treatments:create')
   @Post()
   create(
     @Body() dto: CreateTreatmentDto,
@@ -33,7 +34,7 @@ export class TreatmentsController {
     return this.treatmentsService.create(dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER)
+  @RequirePermission('treatments:update')
   @Patch(':id')
   update(
     @Param('id') id: string,