refactor(apicore-sync): API key and shop feed only, no password login

The sync now talks to ApiCore exclusively through the secured shop
interface: GET /shop-sync with an API key as bearer token. Removed:

- the email/password service-account login (and its MFA handling),
- the fallback to ApiCore's general read endpoints (/harvests,
  /products, /extractions, /bottling-batches, /apiaries).

A missing interface (404) or a rejected key (401/403) now stops the run
with a specific message instead of falling back. APICORE_SYNC_EMAIL and
APICORE_SYNC_PASSWORD are gone from .env.example, README and the k8s
secret template; the system status needs APICORE_API_KEY.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/lib/apicore-mapping.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { isSellableStatus, type ApiCoreProduct, type ApiCoreHarvestWithApiaryName } from "./apicore-client";
+import { isSellableStatus, type ApiCoreProduct, type ApiCoreHarvest } from "./apicore-client";
 import {
   slugForApiCoreSource,
   buildHarvestDescription,
@@ -26,9 +26,7 @@ function makeProduct(overrides: Partial<ApiCoreProduct> = {}): ApiCoreProduct {
   };
 }
 
-function makeHarvest(
-  overrides: Partial<ApiCoreHarvestWithApiaryName> = {}
-): ApiCoreHarvestWithApiaryName {
+function makeHarvest(overrides: Partial<ApiCoreHarvest> = {}): ApiCoreHarvest {
   return {
     id: "cm-harvest-1",
     apiaryId: "cm-apiary-1",
@@ -37,7 +35,6 @@ function makeHarvest(
     honeySuperCount: null,
     grossWeight: null,
     netWeight: null,
-    notes: null,
     apiaryName: "Streuobstwiese",
     ...overrides,
   };
@@ -79,17 +76,6 @@ describe("buildHarvestDescription", () => {
     );
   });
 
-  test("uebernimmt interne ApiCore-Notizen nie in den Shoptext", () => {
-    // Arrange: Betriebsnotiz, die nicht oeffentlich werden darf.
-    const source = makeHarvest({ netWeight: 41, notes: "Volk 7 nach Varroa-Behandlung schwach" });
-
-    // Act
-    const description = buildHarvestDescription(source);
-
-    // Assert
-    expect(description).not.toContain("Varroa");
-    expect(description).not.toContain("Volk 7");
-  });
 
   test("fordert eine Beschreibung an, wenn ApiCore gar nichts liefert", () => {
     // Arrange