feat: T6 wave 3 – treatment books from lot, label print lock, restricted zone, authority notices

- Treatments book their dose from a medicine lot (delta booking on edit,
  bulk all-or-nothing, idempotent); Bestandsbuch columns from the lot,
  FEHLT exactly where treatmentLogGaps reports a gap; Bestandsbuch export
  needs veterinary-medicines:read.
- Label printing: 409 LABEL_PARTICULARS_MISSING on gaps, proof print with
  watermark, PRINT audit before the PDF, check endpoints; digit rules only
  from the seeded ComplianceSettings row (fail closed).
- Restricted zone (Berlin day): create, update, move, merge and CSV import
  blocked inside an active restriction; override with reason and
  compliance:manage, audited, never stored on the colony; split, harvest
  and dissolve stay free; restriction details only with compliance:read.
- Authority notices: settings, herd snapshot, registration/herd change/TSK
  notices with one open draft per kind under the settings lock.
- Label check refinements (geometric reading order, number|unit pairs).
- ARCHITECTURE.md §12.6–12.8, Annahmen 71–77; spec §5.6 Berlin day.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/colonies/restriction-override.ts

@@ -0,0 +1,41 @@
+import { ConflictException } from '@nestjs/common';
+import type { RestrictionCheck } from '../compliance/restricted-zone';
+
+/** 409 when the colony or an apiary changed between the unlocked read and the lock. */
+export function apiaryChangedMeanwhile(): ConflictException {
+  return new ConflictException(
+    'Der Stand wurde gerade geändert. Bitte neu laden.',
+  );
+}
+
+export const NOT_OVERRIDDEN: RestrictionCheck = {
+  overridden: false,
+  restrictionIds: [],
+};
+
+/**
+ * The audit trace of an override: only the reason and the restriction ids,
+ * and only when an active restriction was really overridden. Spread into the
+ * audit entry's afterData - never into data written to the colony.
+ */
+export function overrideTrace(
+  check: RestrictionCheck,
+  reason: string | null | undefined,
+): { restrictionOverride?: { reason: string; restrictionIds: string[] } } {
+  return check.overridden && reason
+    ? { restrictionOverride: { reason, restrictionIds: check.restrictionIds } }
+    : {};
+}
+
+/** The apiary-history note: the override in front of an existing note. */
+export function overrideNote(
+  check: RestrictionCheck,
+  reason: string | null | undefined,
+  note: string | undefined,
+): string | undefined {
+  if (!check.overridden || !reason) {
+    return note;
+  }
+  const prefix = `Ausnahme Sperrbezirk: ${reason}`;
+  return note ? `${prefix}\n${note}` : prefix;
+}