Initial: Rust-Backend mit Clean Architecture (domain/application/infrastructure/api)

Vier-Crate-Workspace mit:
- Domain: Account, Car, Tour, Delivery, DeliveryItem, DeliveryNote, Customer,
  Article, Warehouse, ScanState, AuditAction — alle mit serde + feature-gated
  utoipa::ToSchema.
- Application: Ports (TourRepository, DeliveryRepository, ScanRepository,
  DeliveryNoteRepository, CarRepository, AuthService) und Use Cases.
- Infrastructure: Postgres-Adapter via sqlx (PgTourRepository etc.) +
  Keycloak-AuthService mit JWKS-Cache + OIDC-Discovery.
- API: Axum 0.8, utoipa-OpenAPI + Swagger-UI, JWT-Bearer-Middleware,
  AuthenticatedUser-Extractor.

Endpoints:
- GET /me/tours/today, /tours/{id}, /accounts/{pn}, /me/cars, /health
- POST /sync/tour, /scans (bulk + idempotent via clientScanId),
  /deliveries/{id}/{hold,resume,cancel,complete,notes}, /me/cars
- PUT /tours/{id}/delivery-order, /deliveries/{id}/assigned-car, /me/cars/{id}
- PATCH /me/cars/{id}

Datenmodell:
- 6 Migrationen (accounts, tours/deliveries/items + Stammdaten,
  scan_audit mit clientScanId-UNIQUE, state_reason refactor,
  delivery_notes, cars + FKs nachziehen).
- Business-stabile Beleg-Keys (belegart_id, belegnummer) für ERP-Sync.
- Append-only scan_audit + embedded scan_state als doppelte Wahrheit.

Dev-Setup:
- docker-compose mit Postgres 17 + Keycloak 26
- Keycloak-Realm 'holzleitner' mit Public-Client (PKCE), Testfahrer
  (PN 1001) + Audience-/Personalnummer-Mapper

crates/api/src/error.rs

@@ -0,0 +1,51 @@
+use axum::Json;
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Response};
+use holzleitner_application::error::ApplicationError;
+use holzleitner_application::ports::AuthError;
+use serde_json::json;
+
+/// HTTP-Adapter für Application-Fehler. Mappt jede Variante auf
+/// einen Statuscode + JSON-Body. Verhindert, dass interne Details
+/// (z. B. SQL-Fehler) versehentlich in die Antwort durchschlagen —
+/// das eigentliche Detail wird über `tracing` geloggt.
+pub struct ApiError(pub ApplicationError);
+
+impl From<ApplicationError> for ApiError {
+    fn from(value: ApplicationError) -> Self {
+        Self(value)
+    }
+}
+
+impl From<AuthError> for ApiError {
+    fn from(err: AuthError) -> Self {
+        // Auth-Detail für Debugging loggen, aber NICHT an den Client geben —
+        // dort sehen wir nur „Unauthorized" / „internal error".
+        tracing::debug!(error = %err, "auth verification failed");
+        ApiError(err.into())
+    }
+}
+
+impl IntoResponse for ApiError {
+    fn into_response(self) -> Response {
+        let (status, code) = match &self.0 {
+            ApplicationError::NotFound => (StatusCode::NOT_FOUND, "not_found"),
+            ApplicationError::Unauthorized => (StatusCode::UNAUTHORIZED, "unauthorized"),
+            ApplicationError::Forbidden => (StatusCode::FORBIDDEN, "forbidden"),
+            ApplicationError::Validation(_) => (StatusCode::BAD_REQUEST, "validation"),
+            ApplicationError::Repository(_)
+            | ApplicationError::External(_)
+            | ApplicationError::Unexpected(_) => {
+                tracing::error!(error = %self.0, "internal error");
+                (StatusCode::INTERNAL_SERVER_ERROR, "internal_error")
+            }
+        };
+
+        let body = Json(json!({
+            "error": code,
+            "message": self.0.to_string(),
+        }));
+
+        (status, body).into_response()
+    }
+}