fix(apicore-sync): keep internal notes out of the shop and protect edited drafts

- Harvest descriptions no longer include ApiCore's internal harvest notes.
  The description becomes public on "Veröffentlichen", so a draft published
  without a careful read could have carried operational notes into the shop.
- A repeated sync overwrote unpublished harvest drafts, undoing the admin's
  corrections (season instead of honey type, location, sales text). Drafts
  with an admin audit entry are now left alone and reported as protected.
- Every ApiCore request has a 20 s timeout; before, an ApiCore that accepted
  the connection but never answered left the admin action hanging.
- The sync panel shows the time of the last complete run.
- Client tests: timeout, failed fetch is never treated as an empty source,
  malformed responses are rejected as a whole.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/lib/apicore-client.ts

@@ -47,6 +47,23 @@ import { z } from "zod";
 export class ApiCoreConfigError extends Error {}
 export class ApiCoreRequestError extends Error {}
 
+/**
+ * Obergrenze je Anfrage. Ohne sie haengt die Admin-Aktion bei einem ApiCore,
+ * das die Verbindung annimmt, aber nie antwortet, unbegrenzt — der Knopf
+ * dreht sich, und es gibt weder Ergebnis noch Fehlermeldung.
+ */
+const REQUEST_TIMEOUT_MS = 20_000;
+
+function describeFetchFailure(error: unknown): string {
+  // Checked by name, not instanceof Error: AbortSignal.timeout() rejects with
+  // a DOMException, which is not an Error subclass in every runtime.
+  const name = typeof error === "object" && error !== null && "name" in error ? error.name : undefined;
+  if (name === "TimeoutError" || name === "AbortError") {
+    return `keine Antwort innerhalb von ${REQUEST_TIMEOUT_MS / 1000} Sekunden`;
+  }
+  return error instanceof Error ? error.message : "Unbekannter Fehler";
+}
+
 const loginResponseSchema = z.union([
   z.object({ accessToken: z.string().min(1) }),
   z.object({ mfaRequired: z.literal(true), mfaToken: z.string() }),
@@ -79,10 +96,10 @@ export async function openApiCoreSession(): Promise<ApiCoreSession> {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ email, password }),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });
   } catch (error: unknown) {
-    const message = error instanceof Error ? error.message : "Unbekannter Fehler";
-    throw new ApiCoreRequestError(`ApiCore unter ${baseUrl} nicht erreichbar: ${message}`);
+    throw new ApiCoreRequestError(`ApiCore unter ${baseUrl} nicht erreichbar: ${describeFetchFailure(error)}`);
   }
   if (!res.ok) {
     throw new ApiCoreRequestError(`ApiCore-Login fehlgeschlagen (HTTP ${res.status}).`);
@@ -116,10 +133,10 @@ async function getJson<T>(
   try {
     res = await fetch(`${session.baseUrl}${path}`, {
       headers: { Authorization: `Bearer ${session.token}` },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });
   } catch (error: unknown) {
-    const message = error instanceof Error ? error.message : "Unbekannter Fehler";
-    throw new ApiCoreRequestError(`ApiCore unter ${session.baseUrl} nicht erreichbar: ${message}`);
+    throw new ApiCoreRequestError(`ApiCore unter ${session.baseUrl} nicht erreichbar: ${describeFetchFailure(error)}`);
   }
   if (!res.ok) {
     throw new ApiCoreRequestError(