Initial: Rust-Backend mit Clean Architecture (domain/application/infrastructure/api)

Vier-Crate-Workspace mit:
- Domain: Account, Car, Tour, Delivery, DeliveryItem, DeliveryNote, Customer,
  Article, Warehouse, ScanState, AuditAction — alle mit serde + feature-gated
  utoipa::ToSchema.
- Application: Ports (TourRepository, DeliveryRepository, ScanRepository,
  DeliveryNoteRepository, CarRepository, AuthService) und Use Cases.
- Infrastructure: Postgres-Adapter via sqlx (PgTourRepository etc.) +
  Keycloak-AuthService mit JWKS-Cache + OIDC-Discovery.
- API: Axum 0.8, utoipa-OpenAPI + Swagger-UI, JWT-Bearer-Middleware,
  AuthenticatedUser-Extractor.

Endpoints:
- GET /me/tours/today, /tours/{id}, /accounts/{pn}, /me/cars, /health
- POST /sync/tour, /scans (bulk + idempotent via clientScanId),
  /deliveries/{id}/{hold,resume,cancel,complete,notes}, /me/cars
- PUT /tours/{id}/delivery-order, /deliveries/{id}/assigned-car, /me/cars/{id}
- PATCH /me/cars/{id}

Datenmodell:
- 6 Migrationen (accounts, tours/deliveries/items + Stammdaten,
  scan_audit mit clientScanId-UNIQUE, state_reason refactor,
  delivery_notes, cars + FKs nachziehen).
- Business-stabile Beleg-Keys (belegart_id, belegnummer) für ERP-Sync.
- Append-only scan_audit + embedded scan_state als doppelte Wahrheit.

Dev-Setup:
- docker-compose mit Postgres 17 + Keycloak 26
- Keycloak-Realm 'holzleitner' mit Public-Client (PKCE), Testfahrer
  (PN 1001) + Audience-/Personalnummer-Mapper

crates/application/src/usecases/apply_scans.rs

@@ -0,0 +1,118 @@
+use std::collections::BTreeSet;
+use std::sync::Arc;
+
+use holzleitner_domain::AuditAction;
+
+use crate::dto::{
+    ApplyScansRequest, ApplyScansResponse, ScanEvent, ScanResult, ScanResultStatus,
+};
+use crate::error::ApplicationError;
+use crate::ports::{ApplyScanOutcome, CarRepository, ScanRepository};
+
+/// Wendet eine Liste von Scan-Events idempotent an.
+///
+/// Pro Event ein eigener Vorgang in der Persistence — ein einzelner
+/// Reject blockiert die anderen nicht. Pflicht-Reasons (`Hold` /
+/// `Remove`) werden hier vorab geprüft, ebenso die Ownership aller
+/// in der Batch enthaltenen `actor_car_id`-Werte.
+pub struct ApplyScansUseCase {
+    repository: Arc<dyn ScanRepository>,
+    cars: Arc<dyn CarRepository>,
+}
+
+impl ApplyScansUseCase {
+    pub fn new(repository: Arc<dyn ScanRepository>, cars: Arc<dyn CarRepository>) -> Self {
+        Self { repository, cars }
+    }
+
+    pub async fn execute(
+        &self,
+        request: ApplyScansRequest,
+        actor_personalnummer: i64,
+    ) -> Result<ApplyScansResponse, ApplicationError> {
+        // Distinct car_ids auf einmal validieren — eine Query statt
+        // pro-Event-Roundtrip.
+        let distinct_cars: BTreeSet<uuid::Uuid> = request
+            .scans
+            .iter()
+            .filter_map(|e| e.actor_car_id)
+            .collect();
+        if !distinct_cars.is_empty() {
+            let ids: Vec<uuid::Uuid> = distinct_cars.into_iter().collect();
+            self.cars
+                .assert_owned_by_account(&ids, actor_personalnummer)
+                .await?;
+        }
+
+        let mut results = Vec::with_capacity(request.scans.len());
+
+        for event in &request.scans {
+            if let Some(reason) = pre_validate(event) {
+                results.push(ScanResult {
+                    client_scan_id: event.client_scan_id,
+                    status: ScanResultStatus::Rejected,
+                    reason: Some(reason),
+                    delivery_item_id: None,
+                    new_scan_state: None,
+                });
+                continue;
+            }
+
+            let outcome = self
+                .repository
+                .apply_one(event, actor_personalnummer)
+                .await?;
+
+            results.push(match outcome {
+                ApplyScanOutcome::Applied {
+                    delivery_item_id,
+                    new_state,
+                } => ScanResult {
+                    client_scan_id: event.client_scan_id,
+                    status: ScanResultStatus::Applied,
+                    reason: None,
+                    delivery_item_id: Some(delivery_item_id),
+                    new_scan_state: Some(new_state),
+                },
+                ApplyScanOutcome::Duplicate {
+                    delivery_item_id,
+                    current_state,
+                } => ScanResult {
+                    client_scan_id: event.client_scan_id,
+                    status: ScanResultStatus::Duplicate,
+                    reason: None,
+                    delivery_item_id: Some(delivery_item_id),
+                    new_scan_state: Some(current_state),
+                },
+                ApplyScanOutcome::Rejected { reason } => ScanResult {
+                    client_scan_id: event.client_scan_id,
+                    status: ScanResultStatus::Rejected,
+                    reason: Some(reason),
+                    delivery_item_id: None,
+                    new_scan_state: None,
+                },
+            });
+        }
+
+        Ok(ApplyScansResponse { results })
+    }
+}
+
+/// Validiert Pflichtfelder ohne DB-Aufruf. Liefert `Some(reason)`,
+/// wenn das Event verworfen werden soll.
+fn pre_validate(event: &ScanEvent) -> Option<String> {
+    match event.action {
+        AuditAction::Hold | AuditAction::Remove => {
+            let trimmed = event.reason.as_deref().map(str::trim).unwrap_or("");
+            if trimmed.is_empty() {
+                Some(format!(
+                    "reason required for action {:?}",
+                    event.action
+                ))
+            } else {
+                None
+            }
+        }
+        AuditAction::Scan | AuditAction::Unscan | AuditAction::Unhold => None,
+    }
+}