Add locations (Filialen) as a grouping layer above resources

Enables multiple barbers/staff bookable at the same location and time
-- previously "resource" conflated "location" and "the thing that
can't double-book itself" into one row, so a Filiale could only ever
have exactly one bookable slot at once.

- New `locations` table; `resources.location_id` with a generic,
  idempotent backfill migration (any resource without a location gets
  one auto-created matching its name -- not a one-off for any single
  client, protects any future resource stuck in the old flat shape too)
- `resources`/`resource_hours`/services keep everything they already
  had (hours, min-notice, max-advance, buffer, the no-overlap
  constraint) scoped to resource_id, not location_id -- two barbers at
  one location must stay independently bookable at the same time
- booking_db.py: new locations CRUD mirroring the existing
  resources/services pattern; create_resource now requires a
  location_id, guarded the same way every other tenant check here is
  (get_location existence check, no real FK -- matches this schema's
  existing no-FK convention throughout)
- app.py: new POST /api/locations provisioning route; POST
  /api/resources now requires location_id
- owner_settings.py + settings.html: new self-service "add a Filiale"
  / "add a barber" UI -- there was previously no way to create a
  resource at all outside the CRM/n8n provisioning API
- public_booking.py + book.html: new Filiale picker (reuses the
  existing wireOptionGroup button-group pattern), filtering the
  Mitarbeiter picker to the selected location -- a single-location
  client sees no extra click, same as before Filialen existed
- owner_booking.py + agenda.html: the Filiale show/hide toggle and
  hide-cancelled toggle (shipped earlier this session) now key off
  location_id instead of resource_id, so hiding a Filiale hides every
  barber's bookings at it; manual-booking dropdown grouped by Filiale
- n8n/onboarding.json: default provisioning now creates a "Hauptfiliale"
  location before its resource (inert until re-imported into the live
  n8n instance)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/owner_booking.py

@@ -62,7 +62,9 @@ def _agenda_days(client_id, client, monday):
     end_utc = datetime.combine(monday + timedelta(days=7), datetime.min.time(),
                                 tzinfo=tz).astimezone(timezone.utc)
     rows = bdb.list_bookings_between(client_id, start_utc, end_utc)
-    resource_names = {r["resource_id"]: r["name"] for r in bdb.list_resources(client_id)}
+    all_resources = bdb.list_resources(client_id)
+    resource_names = {r["resource_id"]: r["name"] for r in all_resources}
+    resource_locations = {r["resource_id"]: r["location_id"] for r in all_resources}
 
     by_date = {monday + timedelta(days=i): [] for i in range(7)}
     for row in rows:
@@ -71,6 +73,7 @@ def _agenda_days(client_id, client, monday):
             continue  # a booking straddling the window edge in another tz
         row = dict(row)
         row["resource_name"] = resource_names.get(row["resource_id"], row["resource_id"])
+        row["location_id"] = resource_locations.get(row["resource_id"])
         row["start_local"] = row["start_time"].astimezone(tz)
         by_date[local_date].append(row)
     return sorted(by_date.items())
@@ -83,13 +86,18 @@ def agenda():
     client = bdb.get_client(client_id)
     monday = _week_start(request.args.get("week"))
     today = datetime.now(_tz(client)).date()
+    locations = bdb.list_active_locations(client_id)
+    resources = bdb.list_active_resources(client_id)
+    resources_by_location = {}
+    for r in resources:
+        resources_by_location.setdefault(r["location_id"], []).append(r)
     return render_template(
         "owner/agenda.html", client=client, days=_agenda_days(client_id, client, monday),
         week_start=monday, today=today,
         prev_week=(monday - timedelta(days=7)).isoformat(),
         next_week=(monday + timedelta(days=7)).isoformat(),
         this_week=_week_start(None).isoformat(),
-        resources=bdb.list_active_resources(client_id),
+        locations=locations, resources_by_location=resources_by_location,
         services=bdb.list_active_services(client_id),
         error=request.args.get("error"))