Initial: Rust-Backend mit Clean Architecture (domain/application/infrastructure/api)

Vier-Crate-Workspace mit:
- Domain: Account, Car, Tour, Delivery, DeliveryItem, DeliveryNote, Customer,
  Article, Warehouse, ScanState, AuditAction — alle mit serde + feature-gated
  utoipa::ToSchema.
- Application: Ports (TourRepository, DeliveryRepository, ScanRepository,
  DeliveryNoteRepository, CarRepository, AuthService) und Use Cases.
- Infrastructure: Postgres-Adapter via sqlx (PgTourRepository etc.) +
  Keycloak-AuthService mit JWKS-Cache + OIDC-Discovery.
- API: Axum 0.8, utoipa-OpenAPI + Swagger-UI, JWT-Bearer-Middleware,
  AuthenticatedUser-Extractor.

Endpoints:
- GET /me/tours/today, /tours/{id}, /accounts/{pn}, /me/cars, /health
- POST /sync/tour, /scans (bulk + idempotent via clientScanId),
  /deliveries/{id}/{hold,resume,cancel,complete,notes}, /me/cars
- PUT /tours/{id}/delivery-order, /deliveries/{id}/assigned-car, /me/cars/{id}
- PATCH /me/cars/{id}

Datenmodell:
- 6 Migrationen (accounts, tours/deliveries/items + Stammdaten,
  scan_audit mit clientScanId-UNIQUE, state_reason refactor,
  delivery_notes, cars + FKs nachziehen).
- Business-stabile Beleg-Keys (belegart_id, belegnummer) für ERP-Sync.
- Append-only scan_audit + embedded scan_state als doppelte Wahrheit.

Dev-Setup:
- docker-compose mit Postgres 17 + Keycloak 26
- Keycloak-Realm 'holzleitner' mit Public-Client (PKCE), Testfahrer
  (PN 1001) + Audience-/Personalnummer-Mapper

crates/application/src/dto/tour_sync.rs

@@ -0,0 +1,68 @@
+//! Request-Body für `POST /sync/tour`.
+//!
+//! Diese Struktur ist die Kontaktfläche zum ERP. Sie beschreibt eine
+//! Tagestour eines Fahrers inklusive aller Lieferungen und Positionen.
+//! Identität:
+//! * Tour: `(driver_personalnummer, tour_date)` — Upsert.
+//! * Delivery: `(belegart_id, belegnummer)` — Upsert.
+//! * DeliveryItem: `(delivery, belegzeilen_nr, komponenten_artikel_nr)`.
+//!
+//! Bewusst keine UUIDs vom Sender erwartet — die ERP-Welt arbeitet mit
+//! ihren eigenen business-stabilen Keys, wir generieren UUIDs intern.
+
+use chrono::NaiveDate;
+use serde::{Deserialize, Serialize};
+
+use holzleitner_domain::Address;
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[serde(rename_all = "camelCase")]
+pub struct SyncTourRequest {
+    pub driver_personalnummer: i64,
+    pub tour_date: NaiveDate,
+    pub deliveries: Vec<SyncDelivery>,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[serde(rename_all = "camelCase")]
+pub struct SyncDelivery {
+    pub belegart_id: i64,
+    pub belegnummer: String,
+
+    pub erp_customer_id: i64,
+    pub customer_name: String,
+    pub customer_address: Address,
+
+    /// Snapshot der Lieferadresse (kann von der Stammadresse abweichen).
+    pub delivery_address: Address,
+
+    /// 1-basiert, definiert die initiale Reihenfolge in der App.
+    pub sort_order: i32,
+
+    pub desired_time: Option<String>,
+    pub special_agreements: Option<String>,
+
+    pub items: Vec<SyncDeliveryItem>,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[serde(rename_all = "camelCase")]
+pub struct SyncDeliveryItem {
+    pub belegzeilen_nr: i32,
+    /// Komponenten-Artikelnummer bei aufgelösten Stücklisten, sonst leer.
+    pub komponenten_artikel_nr: Option<String>,
+
+    pub article_number: String,
+    pub article_name: String,
+    /// Default-Lager-Code für den Artikel (Anlage neuer Artikel).
+    pub article_default_warehouse_code: Option<String>,
+    pub article_scannable: bool,
+
+    pub warehouse_code: String,
+    pub warehouse_name: String,
+
+    pub required_quantity: i32,
+}