feat: platform backbone and field capture complete (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), all tasks reviewed:
- webhooks with delivery table, retries and stable delivery id
- calendar handlers; a finished task removes its Outlook event
- tasks, automations, inspections, varroa, treatments, feedings,
  harvests, colonies, wintering, stock and bottling record domain events
  in the same transaction; legacy post-commit calls removed
- row locks through one helper (lockRowForUpdate, lockRowsForShare,
  lockRowsForUpdate)
- job framework with JobRun, cli exit codes, cleanup, task templates,
  daily evaluation, hourly app-backup and the rekey job
- system API and page "Verwaltung > System" with retry
- @nestjs/schedule removed, guard tests against in-process schedulers

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), all tasks reviewed:
- inspection photo offline without metadata
- bulk capture for treatments, feedings and varroa (backend + frontend)
- offline stand mode with service worker, offline pages and packs
- offline session, cold start and logout on shared devices

Docs: ARCHITECTURE.md assumptions and sections updated, TASKS.md.
Gates: backend lint, typecheck, 1770 unit, 420 e2e, build, no schema
drift; frontend lint, typecheck, 913 tests, build. Not rolled out.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/jobs/jobs.module.ts

@@ -0,0 +1,73 @@
+import { Global, Module } from '@nestjs/common';
+import { ConfigModule } from '@nestjs/config';
+import { AuditModule } from '../audit/audit.module';
+import { PermissionResolverService } from '../auth/permissions/permission-resolver.service';
+import { BackupModule } from '../backup/backup.module';
+import { IdempotencyCleanupService } from '../common/idempotency/idempotency-cleanup.service';
+import { DomainEventsModule } from '../domain-events/domain-events.module';
+import { NotificationsModule } from '../notifications/notifications.module';
+import { PrismaModule } from '../prisma/prisma.module';
+import { SystemModule } from '../system/system.module';
+import { TasksModule } from '../tasks/tasks.module';
+import { AppBackupJob } from './app-backup.job';
+import { CleanupJob } from './cleanup.job';
+import { DailyEvaluationJob } from './daily-evaluation.job';
+import { Job } from './job';
+import { JobRegistry, JOBS } from './job-registry';
+import { RekeyJob } from './rekey.job';
+import { TaskTemplatesJob } from './task-templates.job';
+
+/**
+ * PermissionResolverService for the job context (BackupService clears its
+ * cache after a restore, which no job does). Not PermissionsModule: its
+ * PermissionCatalogSyncService would rewrite the permission catalog on
+ * every job start. Global like PermissionsModule, so modules that inject
+ * the resolver load here unchanged.
+ */
+@Global()
+@Module({
+  providers: [PermissionResolverService],
+  exports: [PermissionResolverService],
+})
+class JobPermissionsModule {}
+
+const JOB_CLASSES = [
+  DailyEvaluationJob,
+  TaskTemplatesJob,
+  CleanupJob,
+  AppBackupJob,
+  RekeyJob,
+];
+
+/**
+ * Root module of dist/cli.js, started with
+ * NestFactory.createApplicationContext for exactly one run: the modules
+ * the jobs need, without the HTTP layer (no guards, interceptors, throttler
+ * or routes - controllers of the imported modules are never served) and
+ * without the worker loops. No in-process scheduler: no timer may run
+ * in a job pod.
+ */
+@Module({
+  imports: [
+    ConfigModule.forRoot({ isGlobal: true }),
+    PrismaModule,
+    AuditModule,
+    NotificationsModule,
+    DomainEventsModule,
+    TasksModule,
+    JobPermissionsModule,
+    BackupModule,
+    SystemModule,
+  ],
+  providers: [
+    ...JOB_CLASSES,
+    {
+      provide: JOBS,
+      useFactory: (...jobs: Job[]): Job[] => jobs,
+      inject: JOB_CLASSES,
+    },
+    JobRegistry,
+    IdempotencyCleanupService,
+  ],
+})
+export class JobsModule {}