feat: platform backbone and field capture complete (checkpoint)

Platform backbone (plan 2026-10-13-plattform-rueckgrat), all tasks reviewed:
- webhooks with delivery table, retries and stable delivery id
- calendar handlers; a finished task removes its Outlook event
- tasks, automations, inspections, varroa, treatments, feedings,
  harvests, colonies, wintering, stock and bottling record domain events
  in the same transaction; legacy post-commit calls removed
- row locks through one helper (lockRowForUpdate, lockRowsForShare,
  lockRowsForUpdate)
- job framework with JobRun, cli exit codes, cleanup, task templates,
  daily evaluation, hourly app-backup and the rekey job
- system API and page "Verwaltung > System" with retry
- @nestjs/schedule removed, guard tests against in-process schedulers

Field capture T3 (plan 2026-10-13-t3-erfassung-am-stand), all tasks reviewed:
- inspection photo offline without metadata
- bulk capture for treatments, feedings and varroa (backend + frontend)
- offline stand mode with service worker, offline pages and packs
- offline session, cold start and logout on shared devices

Docs: ARCHITECTURE.md assumptions and sections updated, TASKS.md.
Gates: backend lint, typecheck, 1770 unit, 420 e2e, build, no schema
drift; frontend lint, typecheck, 913 tests, build. Not rolled out.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/test/throttler.e2e-spec.ts

@@ -108,6 +108,55 @@ describe('Database-backed throttler (e2e)', () => {
     expect(record.timeToExpire).toBeLessThanOrEqual(60);
   });
 
+  it('never reports more seconds than the ttl or the block duration (sub-ms rounding)', async () => {
+    const ns = randomUUID();
+    await newApp(ns);
+    const storage = apps[apps.length - 1].get(PrismaThrottlerStorage);
+
+    // The column keeps milliseconds while now() has microseconds; rounding
+    // up by < 1 ms used to turn 60.0004 s into 61. About half of all
+    // timestamps round up, so 60 fresh keys catch it reliably.
+    for (let i = 0; i < 60; i += 1) {
+      const record = await storage.increment(`ms-${i}`, 60000, 0, 60000, 'd');
+      expect(record.timeToExpire).toBeGreaterThanOrEqual(59);
+      expect(record.timeToExpire).toBeLessThanOrEqual(60);
+      expect(record.isBlocked).toBe(true);
+      expect(record.timeToBlockExpire).toBeGreaterThanOrEqual(59);
+      expect(record.timeToBlockExpire).toBeLessThanOrEqual(60);
+    }
+  });
+
+  it('keeps the same bounds when a window restarts or a block starts on an existing row', async () => {
+    const ns = randomUUID();
+    await newApp(ns);
+    const storage = apps[apps.length - 1].get(PrismaThrottlerStorage);
+    const sleep = (ms: number): Promise<void> =>
+      new Promise((resolve) => setTimeout(resolve, ms));
+
+    for (let i = 0; i < 60; i += 1) {
+      // Restart branch: the 1 ms window is over, the row starts again at 1.
+      await storage.increment(`re-${i}`, 1, 10, 60000, 'd');
+      await sleep(5);
+      const restarted = await storage.increment(
+        `re-${i}`,
+        60000,
+        10,
+        60000,
+        'd',
+      );
+      expect(restarted.totalHits).toBe(1);
+      expect(restarted.timeToExpire).toBeGreaterThanOrEqual(59);
+      expect(restarted.timeToExpire).toBeLessThanOrEqual(60);
+
+      // Block branch: hits + 1 > limit on an open window sets blockedUntil.
+      await storage.increment(`bl-${i}`, 60000, 1, 60000, 'd');
+      const blocked = await storage.increment(`bl-${i}`, 60000, 1, 60000, 'd');
+      expect(blocked.isBlocked).toBe(true);
+      expect(blocked.timeToBlockExpire).toBeGreaterThanOrEqual(59);
+      expect(blocked.timeToBlockExpire).toBeLessThanOrEqual(60);
+    }
+  });
+
   it('keeps hits while blocked and releases the block after it expired', async () => {
     const ns = randomUUID();
     await newApp(ns);