feat: öffentliche Herkunftsseiten für Honigchargen + Kunden-QR-Code

Neuer unauthentifizierter Endpunkt GET /api/v1/public/batches/:lot
(Abschnitt 27 der Lastenheft) liefert kontrolliert freigegebene
Rückverfolgbarkeitsdaten einer Abfüllcharge – Produkt, Erntemonat,
Bienenstand-Namen, Schleuderdatum, Wassergehalt – ohne interne IDs,
Adressen oder Koordinaten preiszugeben. Die neue Seite /herkunft/{lot}
liegt außerhalb der (app)-Route-Group und damit ohne Login/Sidebar,
gedacht als Ziel eines QR-Codes auf dem Honigglas. Der bestehende
QR-Dienst kennt jetzt den Entity-Typ "bottling-batches" und verlinkt
intern auf diese neue öffentliche Seite; ein entsprechender
QR-Code-Button samt Klartext-Link steht ab sofort auf der
Abfüllungs-Detailseite bereit.

ApiCore-Backend/src/public/public.controller.ts

@@ -0,0 +1,16 @@
+import { Controller, Get, Param } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { Public } from '../auth/decorators/public.decorator';
+import { PublicBatch, PublicService } from './public.service';
+
+@ApiTags('public')
+@Public()
+@Controller('public/batches')
+export class PublicController {
+  constructor(private readonly publicService: PublicService) {}
+
+  @Get(':lotNumber')
+  findByLot(@Param('lotNumber') lotNumber: string): Promise<PublicBatch> {
+    return this.publicService.findBatchByLot(lotNumber);
+  }
+}

ApiCore-Backend/src/public/public.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { PublicController } from './public.controller';
+import { PublicService } from './public.service';
+
+@Module({
+  controllers: [PublicController],
+  providers: [PublicService],
+})
+export class PublicModule {}

ApiCore-Backend/src/public/public.service.spec.ts

@@ -0,0 +1,69 @@
+import { NotFoundException } from '@nestjs/common';
+import { PublicService } from './public.service';
+import { PrismaService } from '../prisma/prisma.service';
+
+describe('PublicService', () => {
+  let service: PublicService;
+  let prisma: { bottlingBatch: { findUnique: jest.Mock } };
+
+  beforeEach(() => {
+    prisma = { bottlingBatch: { findUnique: jest.fn() } };
+    service = new PublicService(prisma as unknown as PrismaService);
+  });
+
+  it('throws NotFoundException when the lot does not exist', async () => {
+    prisma.bottlingBatch.findUnique.mockResolvedValueOnce(null);
+    await expect(service.findBatchByLot('missing')).rejects.toBeInstanceOf(
+      NotFoundException,
+    );
+  });
+
+  it('shapes the traceability chain into public-safe fields, deduplicating apiaries', async () => {
+    const harvestDate1 = new Date('2026-08-05');
+    const harvestDate2 = new Date('2026-08-12');
+    prisma.bottlingBatch.findUnique.mockResolvedValueOnce({
+      lotNumber: 'WH-2026-001',
+      date: new Date('2026-08-20'),
+      bestBeforeDate: new Date('2028-08-20'),
+      jarSize: 500,
+      product: { name: 'Sommerhonig 500g', description: 'Sortenrein' },
+      honeyBatch: {
+        honeyType: 'Sommerhonig',
+        waterContent: 16.8,
+        extraction: {
+          date: new Date('2026-08-13'),
+          harvests: [
+            {
+              harvest: {
+                date: harvestDate1,
+                apiary: {
+                  id: 'apiary-1',
+                  name: 'Stand Wald',
+                  location: 'Wald',
+                },
+              },
+            },
+            {
+              harvest: {
+                date: harvestDate2,
+                apiary: {
+                  id: 'apiary-1',
+                  name: 'Stand Wald',
+                  location: 'Wald',
+                },
+              },
+            },
+          ],
+        },
+      },
+    });
+
+    const result = await service.findBatchByLot('WH-2026-001');
+
+    expect(result.lotNumber).toBe('WH-2026-001');
+    expect(result.productName).toBe('Sommerhonig 500g');
+    expect(result.waterContent).toBe(16.8);
+    expect(result.apiaries).toEqual([{ name: 'Stand Wald', location: 'Wald' }]);
+    expect(result.harvestDates).toEqual([harvestDate1, harvestDate2]);
+  });
+});

ApiCore-Backend/src/public/public.service.ts

@@ -0,0 +1,77 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.service';
+
+export interface PublicApiaryOrigin {
+  name: string;
+  location: string | null;
+}
+
+export interface PublicBatch {
+  lotNumber: string;
+  productName: string | null;
+  productDescription: string | null;
+  bottledDate: Date;
+  bestBeforeDate: Date;
+  jarSize: number;
+  honeyType: string | null;
+  waterContent: number | null;
+  extractedDate: Date | null;
+  harvestDates: Date[];
+  apiaries: PublicApiaryOrigin[];
+}
+
+@Injectable()
+export class PublicService {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async findBatchByLot(lotNumber: string): Promise<PublicBatch> {
+    const batch = await this.prisma.bottlingBatch.findUnique({
+      where: { lotNumber },
+      include: {
+        product: true,
+        honeyBatch: {
+          include: {
+            extraction: {
+              include: {
+                harvests: {
+                  include: { harvest: { include: { apiary: true } } },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+    if (!batch) {
+      throw new NotFoundException('Charge nicht gefunden');
+    }
+
+    const harvests = batch.honeyBatch.extraction.harvests.map(
+      (entry) => entry.harvest,
+    );
+    const apiaryByName = new Map<string, PublicApiaryOrigin>();
+    for (const harvest of harvests) {
+      apiaryByName.set(harvest.apiary.id, {
+        name: harvest.apiary.name,
+        location: harvest.apiary.location,
+      });
+    }
+    const harvestDates = [...new Set(harvests.map((h) => h.date.getTime()))]
+      .sort((a, b) => a - b)
+      .map((time) => new Date(time));
+
+    return {
+      lotNumber: batch.lotNumber,
+      productName: batch.product?.name ?? null,
+      productDescription: batch.product?.description ?? null,
+      bottledDate: batch.date,
+      bestBeforeDate: batch.bestBeforeDate,
+      jarSize: batch.jarSize,
+      honeyType: batch.honeyBatch.honeyType,
+      waterContent: batch.honeyBatch.waterContent,
+      extractedDate: batch.honeyBatch.extraction.date,
+      harvestDates,
+      apiaries: [...apiaryByName.values()],
+    };
+  }
+}