Add booking stack, client deploys, and back-office updates

- deploy/booking: shared Easy!Appointments stack with brand-matched
  wizard (flatpickr recolor, single-tenant provider hide, iframe
  auto-fit height reporter)
- deploy/clients: per-client isolated nginx compose stacks with
  _template scaffold, new-client.sh, and happynails live site
- deploy/backup: smb-db backup script
- n8n: booking-sync workflow; onboarding tweaks
- playbooks: lead-to-customer lifecycle + outreach
- templates: nail-studio landing previews
- backoffice: app/db/init/compose updates

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backoffice/app/app.py

@@ -23,6 +23,9 @@ from sheets import Sheets
 app = Flask(__name__, static_folder="static", static_url_path="")
 
 CRM_TOKEN = os.environ.get("CRM_API_TOKEN", "")
+# Separate read-only token for the public iCal feed (calendar apps can't send
+# the basic-auth header, so the feed is gated by this query token instead).
+ICS_TOKEN = os.environ.get("ICS_TOKEN", "")
 
 # DB -> Sheets one-way mirror. Postgres is the source of truth; the Sheet is a
 # best-effort projection. A mirror failure never fails the DB write.
@@ -270,6 +273,57 @@ def sync_all():
     return jsonify({"synced": out})
 
 
+def _ics_dt(v):
+    if isinstance(v, datetime):
+        u = v if v.tzinfo else v.replace(tzinfo=timezone.utc)
+        return u.astimezone(timezone.utc).strftime("%Y%m%dT%H%M%SZ")
+    return None
+
+
+def _ics_esc(t):
+    return (str(t or "").replace("\\", "\\\\").replace(";", "\\;")
+            .replace(",", "\\,").replace("\n", "\\n"))
+
+
+@app.get("/api/bookings.ics")
+def bookings_ics():
+    """Read-only iCal feed for Apple/Google Calendar subscription. Gated by the
+    ICS_TOKEN query param (no header auth, so calendar apps can fetch it)."""
+    if not ICS_TOKEN or request.args.get("token") != ICS_TOKEN:
+        return Response("forbidden\n", status=403, mimetype="text/plain")
+    cid = request.args.get("client_id")
+    with db.connect() as conn, conn.cursor() as cur:
+        if cid:
+            cur.execute("SELECT * FROM bookings WHERE client_id = %s ORDER BY start_time", (cid,))
+        else:
+            cur.execute("SELECT * FROM bookings ORDER BY start_time")
+        rows = cur.fetchall()
+    now = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%SZ")
+    out = ["BEGIN:VCALENDAR", "VERSION:2.0", "PRODID:-//smb-crm//bookings//DE",
+           "CALSCALE:GREGORIAN", "METHOD:PUBLISH",
+           "X-WR-CALNAME:" + _ics_esc("Buchungen " + cid if cid else "Buchungen")]
+    for r in rows:
+        st = _ics_dt(r.get("start_time"))
+        if not st:
+            continue
+        summary = r.get("service") or "Termin"
+        if r.get("customer_name"):
+            summary += " – " + r["customer_name"]
+        out += ["BEGIN:VEVENT",
+                "UID:%s@smb-crm" % (r.get("booking_id") or now),
+                "DTSTAMP:%s" % (_ics_dt(r.get("created_at")) or now),
+                "DTSTART:%s" % st]
+        en = _ics_dt(r.get("end_time"))
+        if en:
+            out.append("DTEND:%s" % en)
+        out.append("SUMMARY:" + _ics_esc(summary))
+        if r.get("customer_contact"):
+            out.append("DESCRIPTION:" + _ics_esc("Kontakt: " + r["customer_contact"]))
+        out += ["STATUS:CONFIRMED", "END:VEVENT"]
+    out.append("END:VCALENDAR")
+    return Response("\r\n".join(out) + "\r\n", mimetype="text/calendar")
+
+
 @app.get("/")
 def index():
     return Response(INDEX_HTML, mimetype="text/html")