Owner settings: services, hours/buffer, auto-confirm, notify channel (#21)

Adds a session-authenticated /owner/settings blueprint for services CRUD
(create/edit/deactivate), per-resource opening hours + min-notice/max-advance/
buffer, and client-level auto_confirm/notify_channel — all scoped to the
logged-in owner's own client_id. Extends booking_db.py with the missing
tenant-scoped update_service/update_resource/update_client writes, mirroring
the existing update_booking allowlist pattern.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/app.py

@@ -26,6 +26,7 @@ from public_booking import bp as public_booking_bp
 from manage_booking import bp as manage_booking_bp
 from owner_auth import bp as owner_auth_bp
 from owner_booking import bp as owner_booking_bp
+from owner_settings import bp as owner_settings_bp
 
 app = Flask(__name__, static_folder="static", static_url_path="")
 app.register_blueprint(booking_bp)
@@ -33,6 +34,7 @@ app.register_blueprint(public_booking_bp)
 app.register_blueprint(manage_booking_bp)
 app.register_blueprint(owner_auth_bp)
 app.register_blueprint(owner_booking_bp)
+app.register_blueprint(owner_settings_bp)
 
 # Dedicated secret for the owner-login session cookie -- deliberately not
 # shared with CRM_API_TOKEN or BOOKING_TOKEN_SECRET (#19), same reasoning as