feat(stock): keep shop stock in sync with ApiCore, write sales back

ApiCore now owns the remaining stock per batch; the shop sells from it
and reports every paid sale and every return back.

- Outbox apicore_stock_events, written in the same transaction as the
  status change: paid -> SALE, cancelled-after-payment / refunded return
  -> RETURN onto the batches of the sale, reopened paid order -> SALE.
  Whether a return is due is decided by the open sales in the outbox,
  so unpaid orders never book and nothing is booked twice.
- Delivery right after the response (next/server after()) plus CronJob
  wabenhain-apicore-stock every 10 minutes with 1/5/15/60 min backoff;
  ApiCore deduplicates by event id. Rejected bookings stop and show up
  on the dashboard.
- Reconcile: shop stock = ApiCore remaining - unconfirmed bookings -
  reservations of unpaid orders, in a serializable transaction like the
  checkout. Triggered after bookings, by the signed ApiCore webhook
  stock.changed (ids only, numbers are fetched) and by the sync button.
- Manufactured goods (candles, propolis products, ...): one shop product
  per ApiCore article via Product.apicoreProductId, drafts created by the
  sync, existing products linkable in the product form; new category
  SONSTIGES. Stock field is read-only for linked products.
- OrderItem.apicoreAllocations keeps which lots were sold (recalls).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

.env.example

@@ -100,6 +100,12 @@ SMTP_FROM="Wabenhain <[email protected]>"
 # Details siehe src/lib/apicore-client.ts.
 APICORE_API_URL=
 APICORE_API_KEY=
+# Bestandsabgleich: der Schluessel braucht zusaetzlich "Verkaeufe und
+# Rueckbuchungen des Shops buchen" (shop-sync:write). In ApiCore einen Webhook
+# fuer "stock.changed" auf https://<shop>/api/apicore/webhook anlegen und das
+# dort angezeigte Secret hier eintragen. Ohne Secret wird der Webhook
+# abgelehnt; der CronJob gleicht dann alle 10 Minuten ab.
+APICORE_WEBHOOK_SECRET=
 
 # DHL Parcel DE Shipping API ("Post & Parcel Germany", developer.dhl.com) —
 # ermoeglicht das Erstellen von DHL-Versandmarken per Knopfdruck im
@@ -250,6 +256,8 @@ VAT_RATE_PERCENT=7
 VAT_RATE_PERCENT_HONIG=7
 VAT_RATE_PERCENT_KERZEN=19
 VAT_RATE_PERCENT_PROPOLIS=19
+# Weitere Bienenprodukte (Kategorie SONSTIGES, z. B. Salben, Wachstuecher)
+VAT_RATE_PERCENT_SONSTIGES=19
 
 # Threads, die ffmpeg beim Umrechnen eines hochgeladenen Videos benutzen darf
 # (Admin -> Inhalte -> Hero-Video). Leer lassen heisst 2, erlaubt sind 1 bis 8.