Add locations (Filialen) as a grouping layer above resources

Enables multiple barbers/staff bookable at the same location and time
-- previously "resource" conflated "location" and "the thing that
can't double-book itself" into one row, so a Filiale could only ever
have exactly one bookable slot at once.

- New `locations` table; `resources.location_id` with a generic,
  idempotent backfill migration (any resource without a location gets
  one auto-created matching its name -- not a one-off for any single
  client, protects any future resource stuck in the old flat shape too)
- `resources`/`resource_hours`/services keep everything they already
  had (hours, min-notice, max-advance, buffer, the no-overlap
  constraint) scoped to resource_id, not location_id -- two barbers at
  one location must stay independently bookable at the same time
- booking_db.py: new locations CRUD mirroring the existing
  resources/services pattern; create_resource now requires a
  location_id, guarded the same way every other tenant check here is
  (get_location existence check, no real FK -- matches this schema's
  existing no-FK convention throughout)
- app.py: new POST /api/locations provisioning route; POST
  /api/resources now requires location_id
- owner_settings.py + settings.html: new self-service "add a Filiale"
  / "add a barber" UI -- there was previously no way to create a
  resource at all outside the CRM/n8n provisioning API
- public_booking.py + book.html: new Filiale picker (reuses the
  existing wireOptionGroup button-group pattern), filtering the
  Mitarbeiter picker to the selected location -- a single-location
  client sees no extra click, same as before Filialen existed
- owner_booking.py + agenda.html: the Filiale show/hide toggle and
  hide-cancelled toggle (shipped earlier this session) now key off
  location_id instead of resource_id, so hiding a Filiale hides every
  barber's bookings at it; manual-booking dropdown grouped by Filiale
- n8n/onboarding.json: default provisioning now creates a "Hauptfiliale"
  location before its resource (inert until re-imported into the live
  n8n instance)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/owner_settings.py

@@ -57,18 +57,60 @@ def _parse_time(value):
 def settings():
     client_id = session["client_id"]
     client = bdb.get_client(client_id)
+    locations = bdb.list_locations(client_id)
     resources = bdb.list_resources(client_id)
+    resources_by_location = {}
+    for r in resources:
+        resources_by_location.setdefault(r["location_id"], []).append(r)
     hours_by_resource = {
         r["resource_id"]: bdb.get_resource_hours(client_id, r["resource_id"])
         for r in resources}
     ics_token = bdb.ensure_ics_token(client_id)
     return render_template(
         "owner/settings.html", client=client, services=bdb.list_services(client_id),
-        resources=resources, hours_by_resource=hours_by_resource, weekdays=WEEKDAYS,
+        locations=locations, resources_by_location=resources_by_location,
+        hours_by_resource=hours_by_resource, weekdays=WEEKDAYS,
         ics_url=url_for("bookings_ics", token=ics_token, _external=True),
         error=request.args.get("error"))
 
 
+@bp.post("/locations")
+@login_required
+def create_location():
+    client_id = session["client_id"]
+    name = (request.form.get("name") or "").strip()
+    if not name:
+        return _redirect(error="invalid_location")
+    bdb.create_location(client_id, name)
+    return _redirect()
+
+
+@bp.post("/locations/<location_id>")
+@login_required
+def update_location(location_id):
+    client_id = session["client_id"]
+    name = (request.form.get("name") or "").strip()
+    active = request.form.get("active") == "on"
+    if not name:
+        return _redirect(error="invalid_location")
+    row = bdb.update_location(client_id, location_id, name=name, active=active)
+    if row is None:
+        return _redirect(error="not_found")
+    return _redirect()
+
+
+@bp.post("/resources")
+@login_required
+def create_resource():
+    client_id = session["client_id"]
+    location_id = request.form.get("location_id")
+    name = (request.form.get("name") or "").strip()
+    if not name or bdb.get_location(client_id, location_id) is None:
+        return _redirect(error="invalid_resource")
+    bdb.create_resource(client_id, location_id, name)
+    return _redirect()
+
+
 @bp.post("/services")
 @login_required
 def create_service():
@@ -104,9 +146,13 @@ def update_service(service_id):
 @login_required
 def update_resource(resource_id):
     client_id = session["client_id"]
+    name = (request.form.get("name") or "").strip()
+    active = request.form.get("active") == "on"
     min_notice_minutes = _parse_int(request.form.get("min_notice_minutes"))
     max_advance_days = _parse_int(request.form.get("max_advance_days"))
     buffer_minutes = _parse_int(request.form.get("buffer_minutes"))
+    if not name:
+        return _redirect(error="invalid_resource")
     if min_notice_minutes is None or min_notice_minutes < 0:
         return _redirect(error="invalid_resource")
     if max_advance_days is None or max_advance_days < 0:
@@ -114,7 +160,8 @@ def update_resource(resource_id):
     if buffer_minutes is None or buffer_minutes < 0:
         return _redirect(error="invalid_resource")
     row = bdb.update_resource(
-        client_id, resource_id, min_notice_minutes=min_notice_minutes,
+        client_id, resource_id, name=name, active=active,
+        min_notice_minutes=min_notice_minutes,
         max_advance_days=max_advance_days, buffer_minutes=buffer_minutes)
     if row is None:
         return _redirect(error="not_found")