Availability engine + booking API: create/cancel/reschedule (#16)

Adds the plumbing that makes "can a customer actually get booked" true
end to end at the API layer, on top of #15's schema/tenancy layer.

- resource_hours table + min_notice_minutes/max_advance_days/buffer_minutes
  on resources -- config #15 didn't include but #16 depends on.
- availability.py: pure slot-generation function, correct across a
  Europe/Berlin DST transition (tested both directions).
- booking_api.py: JSON blueprint for slot listing, booking creation
  (auto_confirm -> confirmed/pending), and signed-JWT cancel/reschedule,
  registered into app.py.
- booking_db.py gains resource-hours CRUD, a tenant-scoped busy-bookings
  query for buffer/slot validation, and a read-only client lookup.

A true concurrent-threads test (not just sequential requests) surfaced a
real gap: Postgres can raise DeadlockDetected instead of ExclusionViolation
when two overlapping inserts race the exclusion constraint directly, which
went uncaught and would have 500'd instead of giving the clean 4xx the
ticket requires -- now caught alongside ExclusionViolation.

Also fixed: reschedule used the request's raw UTC offset to pick the
business day instead of the client's own timezone (could pick the wrong
day's hours/bookings near local midnight); the cancel/reschedule JWT no
longer falls back to reusing CRM_API_TOKEN as its signing secret.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/tests/test_booking_db.py

@@ -1,3 +1,4 @@
+import threading
 from datetime import datetime, timedelta, timezone
 
 import pytest
@@ -57,6 +58,39 @@ def test_overlapping_booking_same_resource_raises_conflict():
                             "Haircut", _dt(10, 30), _dt(11, 30))
 
 
+def test_truly_concurrent_overlapping_inserts_only_one_wins():
+    """Two threads, each on its own DB connection, racing to insert the same
+    overlapping slot -- not just a sequential second-request-fails check.
+    The Postgres EXCLUDE constraint (not app-level locking) is what has to
+    serialize this."""
+    r = bdb.create_resource(CLIENT_A, "Chair 1")
+    start_barrier = threading.Barrier(2)
+    results = {}
+
+    def attempt(name, customer):
+        start_barrier.wait()
+        try:
+            results[name] = bdb.create_booking(
+                CLIENT_A, r["resource_id"], customer, f"{customer}@x.com",
+                "Haircut", _dt(10), _dt(11))
+        except bdb.BookingConflict as e:
+            results[name] = e
+
+    t1 = threading.Thread(target=attempt, args=("t1", "Race1"))
+    t2 = threading.Thread(target=attempt, args=("t2", "Race2"))
+    t1.start()
+    t2.start()
+    t1.join()
+    t2.join()
+
+    outcomes = list(results.values())
+    conflicts = [o for o in outcomes if isinstance(o, bdb.BookingConflict)]
+    successes = [o for o in outcomes if not isinstance(o, bdb.BookingConflict)]
+    assert len(conflicts) == 1
+    assert len(successes) == 1
+    assert len(bdb.list_bookings(CLIENT_A)) == 1
+
+
 def test_adjacent_non_overlapping_bookings_both_succeed():
     r = bdb.create_resource(CLIENT_A, "Chair 1")
     bdb.create_booking(CLIENT_A, r["resource_id"], "Alice", "a@x.com",