feat: platform backbone and field capture complete (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), all tasks reviewed:
- webhooks with delivery table, retries and stable delivery id
- calendar handlers; a finished task removes its Outlook event
- tasks, automations, inspections, varroa, treatments, feedings,
  harvests, colonies, wintering, stock and bottling record domain events
  in the same transaction; legacy post-commit calls removed
- row locks through one helper (lockRowForUpdate, lockRowsForShare,
  lockRowsForUpdate)
- job framework with JobRun, cli exit codes, cleanup, task templates,
  daily evaluation, hourly app-backup and the rekey job
- system API and page "Verwaltung > System" with retry
- @nestjs/schedule removed, guard tests against in-process schedulers

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), all tasks reviewed:
- inspection photo offline without metadata
- bulk capture for treatments, feedings and varroa (backend + frontend)
- offline stand mode with service worker, offline pages and packs
- offline session, cold start and logout on shared devices

Docs: ARCHITECTURE.md assumptions and sections updated, TASKS.md.
Gates: backend lint, typecheck, 1770 unit, 420 e2e, build, no schema
drift; frontend lint, typecheck, 913 tests, build. Not rolled out.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/runtime/no-in-process-schedulers.spec.ts

@@ -0,0 +1,54 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+
+// Spec section 9 guard: recurring work runs as Kubernetes CronJobs through
+// dist/cli.js, never as a timer inside an api or worker process.
+const SRC = join(__dirname, '..');
+const PACKAGE_JSON = join(__dirname, '..', '..', 'package.json');
+
+function productionSources(dir: string): string[] {
+  return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      return productionSources(path);
+    }
+    return entry.name.endsWith('.ts') && !entry.name.endsWith('.spec.ts')
+      ? [path]
+      : [];
+  });
+}
+
+function withoutComments(source: string): string {
+  return source.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+}
+
+function offenders(pattern: RegExp): string[] {
+  return productionSources(SRC)
+    .filter((file) => pattern.test(withoutComments(readFileSync(file, 'utf8'))))
+    .map((file) => relative(SRC, file).split(sep).join('/'))
+    .sort();
+}
+
+describe('no in-process schedulers', () => {
+  it('has no @Cron/@Interval/@Timeout, SchedulerRegistry, ScheduleModule or setInterval in src', () => {
+    expect(
+      offenders(
+        /@(Cron|Interval|Timeout)\(|SchedulerRegistry|ScheduleModule|setInterval\(|@nestjs\/schedule/,
+      ),
+    ).toEqual([]);
+  });
+
+  it('no longer depends on @nestjs/schedule', () => {
+    const pkg = JSON.parse(readFileSync(PACKAGE_JSON, 'utf8')) as {
+      dependencies: Record<string, string>;
+    };
+    expect(pkg.dependencies['@nestjs/schedule']).toBeUndefined();
+  });
+
+  it('depends on cron directly, for the cron-expression parsing in the backup schedule', () => {
+    const pkg = JSON.parse(readFileSync(PACKAGE_JSON, 'utf8')) as {
+      dependencies: Record<string, string>;
+    };
+    expect(pkg.dependencies['cron']).toBeDefined();
+  });
+});

ApiCore-Backend/src/runtime/root-module.spec.ts

@@ -1,8 +1,10 @@
-import { forwardRef, Module } from '@nestjs/common';
+import { forwardRef, Module, Type } from '@nestjs/common';
 import { DiscoveryModule } from '@nestjs/core';
+import { Test } from '@nestjs/testing';
 import { AllInOneModule } from '../all-in-one.module';
 import { AppModule } from '../app.module';
 import { ThrottlerStorageModule } from '../common/throttler/throttler-storage.module';
+import { DomainEventRegistry } from '../domain-events/domain-event-registry';
 import { WorkerModule } from '../worker/worker.module';
 import { WorkerRuntimeModule } from '../worker/worker-runtime.module';
 import { isHttpRole, rootModuleFor } from './root-module';
@@ -10,6 +12,24 @@ import { isHttpRole, rootModuleFor } from './root-module';
 const importsOf = (module: object): unknown[] =>
   (Reflect.getMetadata('imports', module) as unknown[] | undefined) ?? [];
 
+/**
+ * The handler ids the DomainEventRegistry discovers under `root`. Compiled
+ * only - no init, so nothing connects or starts a loop; the registry's
+ * boot scan runs by hand on the constructed providers.
+ */
+async function discoveredHandlerIds(root: Type<unknown>): Promise<string[]> {
+  const moduleRef = await Test.createTestingModule({
+    imports: [root],
+  }).compile();
+  try {
+    const registry = moduleRef.get(DomainEventRegistry);
+    registry.onModuleInit();
+    return registry.handlerIds();
+  } finally {
+    await moduleRef.close();
+  }
+}
+
 /**
  * Every module class reachable from `root` through imports - including
  * the imports of dynamic modules (also async ones like
@@ -76,6 +96,16 @@ describe('rootModuleFor', () => {
     expect(reachable).toContain(WorkerRuntimeModule);
     expect(reachable).not.toContain(AppModule);
   });
+
+  // Only the worker dispatches events. A handler in a module the worker
+  // does not import would be registered by the API and never run.
+  it('the worker discovers exactly the domain event handlers of the API', async () => {
+    const api = await discoveredHandlerIds(AppModule);
+    const worker = await discoveredHandlerIds(WorkerModule);
+
+    expect(api).toContain('webhooks.forward');
+    expect(worker).toEqual(api);
+  }, 30_000);
 });
 
 describe('reachableModules', () => {