feat: dedicated, versioned shop-sync feed for Wabenhain

GET /api/v1/shop-sync returns exactly the data ApiCore releases to the
shop: harvest facts, article master data and bottlings with their
harvest ids. Every query uses an explicit select, so notes, colonies,
treatments and fields added to the models later never leave ApiCore
unless deliberately added to the allowlist.

- New permission shop-sync:read (granted to ADMIN automatically, to no
  other role): the shop's service account needs nothing else, in
  particular no access to harvest or extraction records with notes.
- contractVersion 1; only breaking changes bump it.
- Always the full set: small volume, and a full comparison heals missed
  runs by itself.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/auth/permissions/permission-catalog.ts

@@ -306,6 +306,15 @@ export const PERMISSION_CATALOG = [
     ],
     3200,
   ),
+  // Deliberately separate from harvests:read etc.: those endpoints return
+  // internal notes and full records. The shop sync account needs only the
+  // allowlisted feed, so it gets this one permission and nothing else.
+  ...group(
+    'Shop-Synchronisation',
+    'shop-sync',
+    [['read', 'Freigegebene Daten für den Shop lesen']],
+    3300,
+  ),
 ] as const satisfies readonly PermissionCatalogEntry[];
 
 export type PermissionKey = (typeof PERMISSION_CATALOG)[number]['key'];