feat: T6 wave 3 – treatment books from lot, label print lock, restricted zone, authority notices

- Treatments book their dose from a medicine lot (delta booking on edit,
  bulk all-or-nothing, idempotent); Bestandsbuch columns from the lot,
  FEHLT exactly where treatmentLogGaps reports a gap; Bestandsbuch export
  needs veterinary-medicines:read.
- Label printing: 409 LABEL_PARTICULARS_MISSING on gaps, proof print with
  watermark, PRINT audit before the PDF, check endpoints; digit rules only
  from the seeded ComplianceSettings row (fail closed).
- Restricted zone (Berlin day): create, update, move, merge and CSV import
  blocked inside an active restriction; override with reason and
  compliance:manage, audited, never stored on the colony; split, harvest
  and dissolve stay free; restriction details only with compliance:read.
- Authority notices: settings, herd snapshot, registration/herd change/TSK
  notices with one open draft per kind under the settings lock.
- Label check refinements (geometric reading order, number|unit pairs).
- ARCHITECTURE.md §12.6–12.8, Annahmen 71–77; spec §5.6 Berlin day.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/compliance/authority-notices.controller.ts

@@ -0,0 +1,86 @@
+import {
+  Body,
+  Controller,
+  Get,
+  Param,
+  Patch,
+  Post,
+  Query,
+} from '@nestjs/common';
+import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { CurrentUser } from '../auth/decorators/current-user.decorator';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
+import type { AuthenticatedUser } from '../auth/types/authenticated-user';
+import { Idempotent } from '../common/idempotency/idempotent.decorator';
+import { AuthorityNoticesService } from './authority-notices.service';
+import { CreateAuthorityNoticeDto } from './dto/create-authority-notice.dto';
+import { MarkSentDto } from './dto/mark-sent.dto';
+import { NoticeListQuery } from './dto/notice-list-query.dto';
+import { UpdateAuthorityNoticeDto } from './dto/update-authority-notice.dto';
+
+@ApiTags('authority-notices')
+@ApiBearerAuth()
+@Controller('authority-notices')
+export class AuthorityNoticesController {
+  constructor(private readonly notices: AuthorityNoticesService) {}
+
+  @RequirePermission('compliance:read')
+  @Get()
+  findAll(@Query() query: NoticeListQuery) {
+    return this.notices.findAll(query);
+  }
+
+  @RequirePermission('compliance:read')
+  @Get(':id')
+  findOne(@Param('id') id: string) {
+    return this.notices.findOne(id);
+  }
+
+  @RequirePermission('compliance:manage')
+  @Idempotent()
+  @Post()
+  create(
+    @Body() dto: CreateAuthorityNoticeDto,
+    @CurrentUser() actor: AuthenticatedUser,
+  ) {
+    return this.notices.create(dto, actor.id);
+  }
+
+  @RequirePermission('compliance:manage')
+  @Patch(':id')
+  update(
+    @Param('id') id: string,
+    @Body() dto: UpdateAuthorityNoticeDto,
+    @CurrentUser() actor: AuthenticatedUser,
+  ) {
+    return this.notices.update(id, dto, actor.id);
+  }
+
+  @RequirePermission('compliance:manage')
+  @Post(':id/recount')
+  recount(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
+    return this.notices.recount(id, actor.id);
+  }
+
+  @RequirePermission('compliance:manage')
+  @Post(':id/mark-sent')
+  markSent(
+    @Param('id') id: string,
+    @Body() dto: MarkSentDto,
+    @CurrentUser() actor: AuthenticatedUser,
+  ) {
+    return this.notices.markSent(id, dto, actor.id);
+  }
+
+  @RequirePermission('compliance:manage')
+  @Post(':id/reopen')
+  reopen(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
+    return this.notices.reopen(id, actor.id);
+  }
+
+  @RequirePermission('compliance:manage')
+  @Post(':id/cancel')
+  cancel(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
+    return this.notices.cancel(id, actor.id);
+  }
+}