v0.9.1 — Self-update: 403 on trigger mismatch + reliability

webhook returns 200 even when a trigger rule isn't satisfied, which would let
the app's res.ok check falsely report success if the secret drifted. Set
trigger-rule-mismatch-http-response-code: 403 so unauthorized triggers are
clearly rejected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

prisma/schema.prisma

@@ -49,6 +49,40 @@ model AuditEvent {
   @@index([createdAt])
 }
 
+// ---------------------------------------------------------------------------
+// Location — shared hierarchical place tree (garden areas, buildings, rooms,
+// storage bins). The spine for Garden, Inventory, and Pantry. Plants/items/
+// stock all hang off a Location instead of a freeform string.
+// ---------------------------------------------------------------------------
+
+enum LocationKind {
+  AREA      // outdoor garden zone / farm field ("Back fence guild")
+  BUILDING  // house, garage, barn, shed
+  ROOM      // kitchen, basement, pantry room
+  STORAGE   // shelf, bin, cabinet, drawer, freezer
+  OTHER
+}
+
+model Location {
+  id        String       @id @default(cuid())
+  name      String
+  kind      LocationKind @default(AREA)
+  parentId  String?
+  parent    Location?    @relation("LocationTree", fields: [parentId], references: [id], onDelete: SetNull)
+  children  Location[]   @relation("LocationTree")
+  path      String?      // denormalized "House › Basement › Shelf B" for breadcrumbs
+  notes     String?
+  qrSlug    String?      @unique // short slug printed on a QR label → resolves here
+  active    Boolean      @default(true)
+  createdAt DateTime     @default(now())
+  updatedAt DateTime     @updatedAt
+  plants    Plant[]
+
+  @@index([parentId])
+  @@index([kind])
+  @@index([active])
+}
+
 // ---------------------------------------------------------------------------
 // Garden — food forest plant registry
 // ---------------------------------------------------------------------------
@@ -89,7 +123,9 @@ model Plant {
   species     String?       // scientific name (optional)
   variety     String?       // cultivar / variety name
   category    PlantCategory
-  zone        String?       // location on the property, freeform ("Back fence guild", "Front yard")
+  zone        String?       // legacy freeform location — kept during the Location migration (dropped in Release B)
+  locationId  String?       // shared Location spine
+  location    Location?     @relation(fields: [locationId], references: [id], onDelete: SetNull)
   plantedAt   DateTime?     // when it went in the ground
   source      String?       // where it came from ("Jung's Nursery", "from seed", "division from Mom's")
   notes       String?       // general notes about this plant
@@ -104,6 +140,7 @@ model Plant {
 
   @@index([category])
   @@index([zone])
+  @@index([locationId])
   @@index([active])
   @@index([groupId])
 }