feat: RBAC Phase 2a - Bienenvolk-Kern auf @RequirePermission umgestellt

Apiaries, Colonies, Queens, Inspections (+ ColonyInspections),
Tasks, TaskTemplates: @Roles(...) durch @RequirePermission(...) ersetzt.
Schliesst dabei die bisher ungeschuetzten GET-Routen (jeder eingeloggte
Nutzer konnte lesen, unabhaengig von seiner Rolle) mit :read-Rechten.
TaskTemplatesController verliert seinen klassenweiten @Roles-Blanket
zugunsten pro-Route-Rechten (gleiche effektive Berechtigung: nur
ADMIN/BEEKEEPER, jetzt ueber task-templates:* statt Rollen-Liste).

Verifiziert: tsc, lint, e2e (apiaries/colonies/queens/inspections/
tasks/task-templates, 29/29 gruen).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

ApiCore-Backend/src/tasks/tasks.controller.ts

@@ -8,12 +8,8 @@ import {
   Query,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
-import {
-  LegacyRole as Role,
-  TaskPriority,
-  TaskStatus,
-} from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { TaskPriority, TaskStatus } from '../../generated/prisma';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { CreateTaskDto } from './dto/create-task.dto';
@@ -26,6 +22,7 @@ import { TasksService } from './tasks.service';
 export class TasksController {
   constructor(private readonly tasksService: TasksService) {}
 
+  @RequirePermission('tasks:read')
   @Get()
   findAll(
     @Query('status') status?: TaskStatus,
@@ -34,18 +31,19 @@ export class TasksController {
     return this.tasksService.findAll({ status, priority });
   }
 
+  @RequirePermission('tasks:read')
   @Get(':id')
   findOne(@Param('id') id: string) {
     return this.tasksService.findById(id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('tasks:create')
   @Post()
   create(@Body() dto: CreateTaskDto, @CurrentUser() actor: AuthenticatedUser) {
     return this.tasksService.create(dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('tasks:update')
   @Patch(':id')
   update(
     @Param('id') id: string,
@@ -55,7 +53,7 @@ export class TasksController {
     return this.tasksService.update(id, dto, actor.id);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('tasks:complete')
   @Post(':id/complete')
   complete(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
     return this.tasksService.complete(id, actor.id);