Initial: Rust-Backend mit Clean Architecture (domain/application/infrastructure/api)

Vier-Crate-Workspace mit:
- Domain: Account, Car, Tour, Delivery, DeliveryItem, DeliveryNote, Customer,
  Article, Warehouse, ScanState, AuditAction — alle mit serde + feature-gated
  utoipa::ToSchema.
- Application: Ports (TourRepository, DeliveryRepository, ScanRepository,
  DeliveryNoteRepository, CarRepository, AuthService) und Use Cases.
- Infrastructure: Postgres-Adapter via sqlx (PgTourRepository etc.) +
  Keycloak-AuthService mit JWKS-Cache + OIDC-Discovery.
- API: Axum 0.8, utoipa-OpenAPI + Swagger-UI, JWT-Bearer-Middleware,
  AuthenticatedUser-Extractor.

Endpoints:
- GET /me/tours/today, /tours/{id}, /accounts/{pn}, /me/cars, /health
- POST /sync/tour, /scans (bulk + idempotent via clientScanId),
  /deliveries/{id}/{hold,resume,cancel,complete,notes}, /me/cars
- PUT /tours/{id}/delivery-order, /deliveries/{id}/assigned-car, /me/cars/{id}
- PATCH /me/cars/{id}

Datenmodell:
- 6 Migrationen (accounts, tours/deliveries/items + Stammdaten,
  scan_audit mit clientScanId-UNIQUE, state_reason refactor,
  delivery_notes, cars + FKs nachziehen).
- Business-stabile Beleg-Keys (belegart_id, belegnummer) für ERP-Sync.
- Append-only scan_audit + embedded scan_state als doppelte Wahrheit.

Dev-Setup:
- docker-compose mit Postgres 17 + Keycloak 26
- Keycloak-Realm 'holzleitner' mit Public-Client (PKCE), Testfahrer
  (PN 1001) + Audience-/Personalnummer-Mapper

crates/api/src/state.rs

@@ -0,0 +1,33 @@
+use std::sync::Arc;
+
+use holzleitner_application::ports::AuthService;
+use holzleitner_application::usecases::{
+    ApplyDeliveryActionUseCase, ApplyScansUseCase, AssignCarToDeliveryUseCase,
+    CreateDeliveryNoteUseCase, CreateMyCarUseCase, GetAccountUseCase, GetTourUseCase,
+    ListMyCarsUseCase, ListMyToursTodayUseCase, SetDeliveryOrderUseCase, SyncTourUseCase,
+    UpdateMyCarUseCase,
+};
+
+/// Shared application state, der per Axum's `State`-Extractor in alle
+/// Handler hineingegeben wird. Use Cases und Services liegen hinter
+/// `Arc`, damit `Clone` billig ist und Requests sich keine Locks teilen.
+///
+/// Das `AppState`-Klon wird zudem in die JWT-Middleware geschleust
+/// (`from_fn_with_state`), die den `auth_service` nutzt — derselbe
+/// Trait-Objekt-Arc wie die Handler.
+#[derive(Clone)]
+pub struct AppState {
+    pub get_account: Arc<GetAccountUseCase>,
+    pub get_tour: Arc<GetTourUseCase>,
+    pub list_my_tours_today: Arc<ListMyToursTodayUseCase>,
+    pub sync_tour: Arc<SyncTourUseCase>,
+    pub set_delivery_order: Arc<SetDeliveryOrderUseCase>,
+    pub apply_scans: Arc<ApplyScansUseCase>,
+    pub apply_delivery_action: Arc<ApplyDeliveryActionUseCase>,
+    pub create_delivery_note: Arc<CreateDeliveryNoteUseCase>,
+    pub list_my_cars: Arc<ListMyCarsUseCase>,
+    pub create_my_car: Arc<CreateMyCarUseCase>,
+    pub update_my_car: Arc<UpdateMyCarUseCase>,
+    pub assign_car_to_delivery: Arc<AssignCarToDeliveryUseCase>,
+    pub auth_service: Arc<dyn AuthService>,
+}