Initial: Rust-Backend mit Clean Architecture (domain/application/infrastructure/api)

Vier-Crate-Workspace mit:
- Domain: Account, Car, Tour, Delivery, DeliveryItem, DeliveryNote, Customer,
  Article, Warehouse, ScanState, AuditAction — alle mit serde + feature-gated
  utoipa::ToSchema.
- Application: Ports (TourRepository, DeliveryRepository, ScanRepository,
  DeliveryNoteRepository, CarRepository, AuthService) und Use Cases.
- Infrastructure: Postgres-Adapter via sqlx (PgTourRepository etc.) +
  Keycloak-AuthService mit JWKS-Cache + OIDC-Discovery.
- API: Axum 0.8, utoipa-OpenAPI + Swagger-UI, JWT-Bearer-Middleware,
  AuthenticatedUser-Extractor.

Endpoints:
- GET /me/tours/today, /tours/{id}, /accounts/{pn}, /me/cars, /health
- POST /sync/tour, /scans (bulk + idempotent via clientScanId),
  /deliveries/{id}/{hold,resume,cancel,complete,notes}, /me/cars
- PUT /tours/{id}/delivery-order, /deliveries/{id}/assigned-car, /me/cars/{id}
- PATCH /me/cars/{id}

Datenmodell:
- 6 Migrationen (accounts, tours/deliveries/items + Stammdaten,
  scan_audit mit clientScanId-UNIQUE, state_reason refactor,
  delivery_notes, cars + FKs nachziehen).
- Business-stabile Beleg-Keys (belegart_id, belegnummer) für ERP-Sync.
- Append-only scan_audit + embedded scan_state als doppelte Wahrheit.

Dev-Setup:
- docker-compose mit Postgres 17 + Keycloak 26
- Keycloak-Realm 'holzleitner' mit Public-Client (PKCE), Testfahrer
  (PN 1001) + Audience-/Personalnummer-Mapper

crates/application/src/usecases/sync_tour.rs

@@ -0,0 +1,54 @@
+use std::sync::Arc;
+
+use uuid::Uuid;
+
+use crate::dto::SyncTourRequest;
+use crate::error::ApplicationError;
+use crate::ports::TourRepository;
+
+/// Übernimmt eine Tagestour aus dem ERP. Idempotent: wiederholte Aufrufe
+/// mit gleichem `(driver_personalnummer, tour_date)` aktualisieren die
+/// bestehende Tour, statt eine neue anzulegen.
+///
+/// Validierung läuft hier in der Application-Schicht — die Repository-
+/// Schicht darf einen sauberen Datensatz erwarten.
+pub struct SyncTourUseCase {
+    repository: Arc<dyn TourRepository>,
+}
+
+impl SyncTourUseCase {
+    pub fn new(repository: Arc<dyn TourRepository>) -> Self {
+        Self { repository }
+    }
+
+    pub async fn execute(&self, request: SyncTourRequest) -> Result<Uuid, ApplicationError> {
+        if request.deliveries.is_empty() {
+            return Err(ApplicationError::Validation(
+                "tour ohne lieferungen abgelehnt".into(),
+            ));
+        }
+        for delivery in &request.deliveries {
+            if delivery.belegnummer.trim().is_empty() {
+                return Err(ApplicationError::Validation(
+                    "leere belegnummer".into(),
+                ));
+            }
+            if delivery.items.is_empty() {
+                return Err(ApplicationError::Validation(format!(
+                    "lieferung {} ohne positionen",
+                    delivery.belegnummer
+                )));
+            }
+            for item in &delivery.items {
+                if item.required_quantity <= 0 {
+                    return Err(ApplicationError::Validation(format!(
+                        "lieferung {}, position {}: required_quantity muss > 0 sein",
+                        delivery.belegnummer, item.belegzeilen_nr
+                    )));
+                }
+            }
+        }
+
+        self.repository.upsert_from_sync(&request).await
+    }
+}