feat: T4 waves 1-2 - rule configs, schema, suggestions core, season, rule forms

- Rule configs with typed parsers and registry; Berlin day helpers
- Schema: T4 enums, Suggestion table, feed vocabulary (feedStatus as
  ColonyCondition with legacy text mapping), split queen source,
  varroa sample size; migration harness for data migrations
- SuggestionsService: propose/refresh/resolve/obsolete/expire,
  accept/dismiss/reopen incl. bulk, lock order, concurrency e2e
- SeasonService: phenology-based segments, inspection/varroa due dates,
  queen age; TimeEventsStep with JobPartialFailure
- Frontend: per-rule settings forms with visible value sources

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/auth/permissions/permission-resolver.module.ts

@@ -0,0 +1,16 @@
+import { Global, Module } from '@nestjs/common';
+import { PermissionResolverService } from './permission-resolver.service';
+
+/**
+ * PermissionResolverService for the job and worker context (BackupService
+ * clears its cache after a restore, which no job does). Not
+ * PermissionsModule: its PermissionCatalogSyncService would rewrite the
+ * permission catalog on every job or worker start. Global like
+ * PermissionsModule, so modules that inject the resolver load here unchanged.
+ */
+@Global()
+@Module({
+  providers: [PermissionResolverService],
+  exports: [PermissionResolverService],
+})
+export class JobPermissionsModule {}