fix(apicore-sync): keep internal notes out of the shop and protect edited drafts

- Harvest descriptions no longer include ApiCore's internal harvest notes.
  The description becomes public on "Veröffentlichen", so a draft published
  without a careful read could have carried operational notes into the shop.
- A repeated sync overwrote unpublished harvest drafts, undoing the admin's
  corrections (season instead of honey type, location, sales text). Drafts
  with an admin audit entry are now left alone and reported as protected.
- Every ApiCore request has a 20 s timeout; before, an ApiCore that accepted
  the connection but never answered left the admin action hanging.
- The sync panel shows the time of the last complete run.
- Client tests: timeout, failed fetch is never treated as an empty source,
  malformed responses are rejected as a whole.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/lib/apicore-mapping.ts

@@ -24,14 +24,18 @@ export function slugForApiCoreSource(sourceId: string): string {
 /**
  * Wabenhains Harvest.description ist ein Pflichtfeld, ApiCore liefert dafuer
  * kein Aequivalent — baut stattdessen eine sinnvolle Vorbefuellung aus den
- * vorhandenen Mengen-/Notizfeldern, die der Admin beim Review verfeinert.
+ * vorhandenen Mengenfeldern, die der Admin beim Review verfeinert.
+ *
+ * ApiCores `notes` werden bewusst NICHT uebernommen: das sind interne
+ * Betriebsnotizen des Imkers (Beobachtungen, Probleme, Behandlungshinweise),
+ * und die Beschreibung wird mit dem Veroeffentlichen oeffentlich. Ein Klick
+ * auf "Veroeffentlichen" ohne Durchlesen duerfte sie sonst in den Shop tragen.
  */
 export function buildHarvestDescription(source: ApiCoreHarvestWithApiaryName): string {
   const parts: string[] = [];
   if (source.honeySuperCount != null) parts.push(`${source.honeySuperCount} Honigräume`);
   if (source.grossWeight != null) parts.push(`Bruttogewicht ${source.grossWeight} kg`);
   if (source.netWeight != null) parts.push(`Nettogewicht ${source.netWeight} kg`);
-  if (source.notes?.trim()) parts.push(source.notes.trim());
   const detail = parts.length > 0 ? parts.join(" · ") : "Bitte Beschreibung ergänzen.";
   return `Automatisch aus ApiCore importiert. ${detail}`;
 }