feat: dedicated, versioned shop-sync feed for Wabenhain

GET /api/v1/shop-sync returns exactly the data ApiCore releases to the
shop: harvest facts, article master data and bottlings with their
harvest ids. Every query uses an explicit select, so notes, colonies,
treatments and fields added to the models later never leave ApiCore
unless deliberately added to the allowlist.

- New permission shop-sync:read (granted to ADMIN automatically, to no
  other role): the shop's service account needs nothing else, in
  particular no access to harvest or extraction records with notes.
- contractVersion 1; only breaking changes bump it.
- Always the full set: small volume, and a full comparison heals missed
  runs by itself.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/app.module.ts

@@ -44,6 +44,7 @@ import { WeatherModule } from './weather/weather.module';
 import { ProfileModule } from './profile/profile.module';
 import { SiteSettingsModule } from './site-settings/site-settings.module';
 import { BackupModule } from './backup/backup.module';
+import { ShopSyncModule } from './shop-sync/shop-sync.module';
 import { JwtAuthGuard } from './auth/guards/jwt-auth.guard';
 import { PermissionsGuard } from './auth/guards/permissions.guard';
 import { PermissionsModule } from './auth/permissions/permissions.module';
@@ -97,6 +98,7 @@ import { IdempotencyCleanupService } from './common/idempotency/idempotency-clea
     ProfileModule,
     SiteSettingsModule,
     BackupModule,
+    ShopSyncModule,
   ],
   controllers: [],
   providers: [