Add locations (Filialen) as a grouping layer above resources

Enables multiple barbers/staff bookable at the same location and time
-- previously "resource" conflated "location" and "the thing that
can't double-book itself" into one row, so a Filiale could only ever
have exactly one bookable slot at once.

- New `locations` table; `resources.location_id` with a generic,
  idempotent backfill migration (any resource without a location gets
  one auto-created matching its name -- not a one-off for any single
  client, protects any future resource stuck in the old flat shape too)
- `resources`/`resource_hours`/services keep everything they already
  had (hours, min-notice, max-advance, buffer, the no-overlap
  constraint) scoped to resource_id, not location_id -- two barbers at
  one location must stay independently bookable at the same time
- booking_db.py: new locations CRUD mirroring the existing
  resources/services pattern; create_resource now requires a
  location_id, guarded the same way every other tenant check here is
  (get_location existence check, no real FK -- matches this schema's
  existing no-FK convention throughout)
- app.py: new POST /api/locations provisioning route; POST
  /api/resources now requires location_id
- owner_settings.py + settings.html: new self-service "add a Filiale"
  / "add a barber" UI -- there was previously no way to create a
  resource at all outside the CRM/n8n provisioning API
- public_booking.py + book.html: new Filiale picker (reuses the
  existing wireOptionGroup button-group pattern), filtering the
  Mitarbeiter picker to the selected location -- a single-location
  client sees no extra click, same as before Filialen existed
- owner_booking.py + agenda.html: the Filiale show/hide toggle and
  hide-cancelled toggle (shipped earlier this session) now key off
  location_id instead of resource_id, so hiding a Filiale hides every
  barber's bookings at it; manual-booking dropdown grouped by Filiale
- n8n/onboarding.json: default provisioning now creates a "Hauptfiliale"
  location before its resource (inert until re-imported into the live
  n8n instance)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/app.py

@@ -254,6 +254,25 @@ def _parse_hours_time(value):
         return None
 
 
+@app.post("/api/locations")
+def create_location_route():
+    """Onboarding provisioning: a default location (Filiale) for a new
+    client, created before its first resource -- create_resource_route
+    requires a location_id."""
+    if not authed():
+        return jsonify({"error": "forbidden"}), 403
+    body = request.get_json(force=True, silent=True) or {}
+    client_id = body.get("client_id")
+    name = (body.get("name") or "").strip()
+    if not client_id or not name:
+        return jsonify({"error": "client_id and name required"}), 400
+    row = bdb.create_location(client_id, name)
+    with db.connect() as conn, conn.cursor() as cur:
+        log_activity(cur, client_id, "add location", f"location_id={row['location_id']}")
+        conn.commit()
+    return jsonify({"location_id": row["location_id"]}), 201
+
+
 @app.post("/api/resources")
 def create_resource_route():
     """Onboarding provisioning (#24): a default bookable resource for a new
@@ -264,10 +283,14 @@ def create_resource_route():
         return jsonify({"error": "forbidden"}), 403
     body = request.get_json(force=True, silent=True) or {}
     client_id = body.get("client_id")
+    location_id = body.get("location_id")
     name = (body.get("name") or "").strip()
-    if not client_id or not name:
-        return jsonify({"error": "client_id and name required"}), 400
-    row = bdb.create_resource(client_id, name)
+    if not client_id or not location_id or not name:
+        return jsonify({"error": "client_id, location_id and name required"}), 400
+    try:
+        row = bdb.create_resource(client_id, location_id, name)
+    except bdb.UnknownLocation:
+        return jsonify({"error": "location not found"}), 404
     for h in body.get("hours") or []:
         opens_at = _parse_hours_time(h.get("opens_at"))
         closes_at = _parse_hours_time(h.get("closes_at"))