feat: T6 wave 3 – treatment books from lot, label print lock, restricted zone, authority notices

- Treatments book their dose from a medicine lot (delta booking on edit,
  bulk all-or-nothing, idempotent); Bestandsbuch columns from the lot,
  FEHLT exactly where treatmentLogGaps reports a gap; Bestandsbuch export
  needs veterinary-medicines:read.
- Label printing: 409 LABEL_PARTICULARS_MISSING on gaps, proof print with
  watermark, PRINT audit before the PDF, check endpoints; digit rules only
  from the seeded ComplianceSettings row (fail closed).
- Restricted zone (Berlin day): create, update, move, merge and CSV import
  blocked inside an active restriction; override with reason and
  compliance:manage, audited, never stored on the colony; split, harvest
  and dissolve stay free; restriction details only with compliance:read.
- Authority notices: settings, herd snapshot, registration/herd change/TSK
  notices with one open draft per kind under the settings lock.
- Label check refinements (geometric reading order, number|unit pairs).
- ARCHITECTURE.md §12.6–12.8, Annahmen 71–77; spec §5.6 Berlin day.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/test/utils/pdf-text.ts

@@ -0,0 +1,31 @@
+import { inflateSync } from 'node:zlib';
+
+/**
+ * The text a pdfkit document prints, for assertions in tests: inflates the
+ * content streams and joins the strings of every text-showing operator
+ * (hex strings of the standard fonts, one line per operator). Not a PDF
+ * parser - it reads what pdfkit writes with the built-in Helvetica.
+ */
+export function pdfText(pdf: Buffer): string {
+  const source = pdf.toString('latin1');
+  const lines: string[] = [];
+  const streams = source.matchAll(/stream\r?\n([\s\S]*?)\r?\nendstream/g);
+  for (const [, raw] of streams) {
+    let content: string;
+    try {
+      content = inflateSync(Buffer.from(raw, 'latin1')).toString('latin1');
+    } catch {
+      continue;
+    }
+    for (const operator of content.matchAll(
+      /\[([^\]]*)\]\s*TJ|<([0-9a-fA-F]+)>\s*Tj/g,
+    )) {
+      const parts = operator[1] ?? `<${operator[2]}>`;
+      const text = [...parts.matchAll(/<([0-9a-fA-F]*)>/g)]
+        .map(([, hex]) => Buffer.from(hex, 'hex').toString('latin1'))
+        .join('');
+      lines.push(text);
+    }
+  }
+  return lines.join('\n');
+}