feat: T4 wave 10 – bottling quality, phenology and honey chain UI, Telegram link/receive and ops

- Bottling quality: water content above the legal limit (strict >) answers
  409 CONFIRMATION_REQUIRED bound to the measured value; prefill for jar
  size, best-before (shelfLifeMonths, month-end clamping) and water content;
  impossible dates give 400; water-content checks in src/common/quality.
- Frontend phenology: "Entwicklung melden" sheet, IndexedDB v4 queue,
  season header on the apiary page, confirmed revoke for all apiaries.
- Frontend honey chain: "Vorschlag aus …" hints with explicit take-over,
  prefill status note, movement ledger with withdraw/correct dialogs.
- Telegram: link tokens (hashed, single use), private-chat receiver with
  lease and offset CAS, bounded poison-update skip, Retry-After, pending
  deliveries skipped on disconnect; system API for deliveries and retry;
  worker-only secret wiring and manifest policy tests.
- ARCHITECTURE.md §7, §9, §10, §11.11–11.13, Annahmen 51–55.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

deploy/k8s/overlays/encry/configmap-backend.yaml

@@ -22,6 +22,7 @@ data:
   WEATHER_HISTORY_SOURCE: "open-meteo"
   OPEN_METEO_FORECAST_URL: "https://api.open-meteo.com/v1/forecast"
   OPEN_METEO_ARCHIVE_URL: "https://archive-api.open-meteo.com/v1/archive"
-  # Telegram: Name des Bots (ohne @) fuer den Deep Link, sobald der Bot bei
-  # BotFather angelegt ist. Das Token liegt im Secret apicore-telegram (nur Worker).
-  # TELEGRAM_BOT_USERNAME: "<bot-username>"
+  # Telegram: Name des Bots (ohne @) fuer den Deep Link. Leer, solange der Bot
+  # bei BotFather noch nicht angelegt ist (Runbook); dann den Namen eintragen.
+  # Das Token liegt im Secret apicore-telegram (nur Worker).
+  TELEGRAM_BOT_USERNAME: ""