feat: platform backbone and field capture complete (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), all tasks reviewed:
- webhooks with delivery table, retries and stable delivery id
- calendar handlers; a finished task removes its Outlook event
- tasks, automations, inspections, varroa, treatments, feedings,
  harvests, colonies, wintering, stock and bottling record domain events
  in the same transaction; legacy post-commit calls removed
- row locks through one helper (lockRowForUpdate, lockRowsForShare,
  lockRowsForUpdate)
- job framework with JobRun, cli exit codes, cleanup, task templates,
  daily evaluation, hourly app-backup and the rekey job
- system API and page "Verwaltung > System" with retry
- @nestjs/schedule removed, guard tests against in-process schedulers

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), all tasks reviewed:
- inspection photo offline without metadata
- bulk capture for treatments, feedings and varroa (backend + frontend)
- offline stand mode with service worker, offline pages and packs
- offline session, cold start and logout on shared devices

Docs: ARCHITECTURE.md assumptions and sections updated, TASKS.md.
Gates: backend lint, typecheck, 1770 unit, 420 e2e, build, no schema
drift; frontend lint, typecheck, 913 tests, build. Not rolled out.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/cli.spec.ts

@@ -0,0 +1,61 @@
+import { bootstrapCli } from './cli';
+import * as runCliModule from './jobs/run-cli';
+
+const VALID_ENV: NodeJS.ProcessEnv = {
+  DATABASE_URL: 'postgresql://job:secret@db/app',
+  JWT_ACCESS_SECRET: 'a'.repeat(32),
+};
+
+describe('bootstrapCli', () => {
+  let runCli: jest.SpyInstance;
+
+  beforeEach(() => {
+    runCli = jest.spyOn(runCliModule, 'runCli').mockResolvedValue(0);
+  });
+
+  afterEach(() => jest.restoreAllMocks());
+
+  // A misconfigured CronJob pod must fail before any module connects.
+  it.each([
+    [
+      'a role of another entry point',
+      { ...VALID_ENV, APICORE_ROLE: 'worker' },
+      'APICORE_ROLE=worker cannot start dist/cli.js',
+    ],
+    [
+      '"all" in production',
+      { ...VALID_ENV, NODE_ENV: 'production', APICORE_ROLE: 'all' },
+      'APICORE_ROLE=all is for local development and tests only',
+    ],
+    [
+      'no role in production',
+      { ...VALID_ENV, NODE_ENV: 'production' },
+      'APICORE_ROLE is required in production',
+    ],
+    [
+      'a missing DATABASE_URL',
+      { JWT_ACCESS_SECRET: VALID_ENV.JWT_ACCESS_SECRET },
+      'Missing required environment variable(s): DATABASE_URL',
+    ],
+  ])(
+    'refuses %s before running a job',
+    async (_case, env: NodeJS.ProcessEnv, message: string) => {
+      await expect(bootstrapCli(['cleanup'], env)).rejects.toThrow(message);
+
+      expect(runCli).not.toHaveBeenCalled();
+    },
+  );
+
+  it('runs the named job with its arguments and returns the exit code', async () => {
+    runCli.mockResolvedValue(1);
+
+    await expect(
+      bootstrapCli(['rekey', '--dry-run'], {
+        ...VALID_ENV,
+        APICORE_ROLE: 'job',
+      }),
+    ).resolves.toBe(1);
+
+    expect(runCli).toHaveBeenCalledWith(['rekey', '--dry-run']);
+  });
+});