feat(apicore-sync): read from ApiCore's dedicated shop feed

The sync now fetches everything from ApiCore's GET /shop-sync in one call:
an allowlisted feed (harvest facts, article master data, bottlings) that
never contains internal notes and needs only the single permission
"shop-sync:read" instead of read access to harvests, extractions etc.

- Contract version is checked; an unknown version stops the run with a
  clear message and writes nothing. Extra fields are ignored.
- One consistent snapshot, processed only after it arrived completely: a
  failed fetch writes nothing (no more half state of new harvests and old
  batches); the batch-load-error path is gone.
- Falls back to the previous per-resource endpoints when ApiCore answers
  404, so both packages can be deployed independently.
- .env.example documents the reduced permission.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/i18n/dictionaries/en.ts

@@ -1150,7 +1150,6 @@ export const en: Dictionary = {
     lastRun: (when) => `Last complete run: ${when}`,
     neverRun: "No complete run yet.",
     error: "Sync with ApiCore failed.",
-    batchLoadError: "Batches could not be loaded — without them no products are created either",
   },
   adminProductsPage: {
     backToDashboard: "Back to dashboard",