Add locations (Filialen) as a grouping layer above resources

Enables multiple barbers/staff bookable at the same location and time
-- previously "resource" conflated "location" and "the thing that
can't double-book itself" into one row, so a Filiale could only ever
have exactly one bookable slot at once.

- New `locations` table; `resources.location_id` with a generic,
  idempotent backfill migration (any resource without a location gets
  one auto-created matching its name -- not a one-off for any single
  client, protects any future resource stuck in the old flat shape too)
- `resources`/`resource_hours`/services keep everything they already
  had (hours, min-notice, max-advance, buffer, the no-overlap
  constraint) scoped to resource_id, not location_id -- two barbers at
  one location must stay independently bookable at the same time
- booking_db.py: new locations CRUD mirroring the existing
  resources/services pattern; create_resource now requires a
  location_id, guarded the same way every other tenant check here is
  (get_location existence check, no real FK -- matches this schema's
  existing no-FK convention throughout)
- app.py: new POST /api/locations provisioning route; POST
  /api/resources now requires location_id
- owner_settings.py + settings.html: new self-service "add a Filiale"
  / "add a barber" UI -- there was previously no way to create a
  resource at all outside the CRM/n8n provisioning API
- public_booking.py + book.html: new Filiale picker (reuses the
  existing wireOptionGroup button-group pattern), filtering the
  Mitarbeiter picker to the selected location -- a single-location
  client sees no extra click, same as before Filialen existed
- owner_booking.py + agenda.html: the Filiale show/hide toggle and
  hide-cancelled toggle (shipped earlier this session) now key off
  location_id instead of resource_id, so hiding a Filiale hides every
  barber's bookings at it; manual-booking dropdown grouped by Filiale
- n8n/onboarding.json: default provisioning now creates a "Hauptfiliale"
  location before its resource (inert until re-imported into the live
  n8n instance)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/templates/owner/agenda.html

@@ -56,10 +56,10 @@
   <h1>{{ client.business_name if client else 'Kalender' }}</h1>
 
   <div class="filiale-filter" id="filialeFilter">
-    {% if resources|length > 1 %}
+    {% if locations|length > 1 %}
     <p class="flabel">Filialen:</p>
-    {% for r in resources %}
-    <label><input type="checkbox" class="res-toggle" value="{{ r.resource_id }}" checked> {{ r.name }}</label>
+    {% for loc in locations %}
+    <label><input type="checkbox" class="loc-toggle" value="{{ loc.location_id }}" checked> {{ loc.name }}</label>
     {% endfor %}
     {% endif %}
     <label><input type="checkbox" id="showCancelled"> Stornierte anzeigen</label>
@@ -98,7 +98,7 @@
       <thead><tr><th>Zeit</th><th>Kunde</th><th>Leistung</th><th>Ressource</th><th>Status</th><th></th></tr></thead>
       <tbody>
       {% for b in bookings %}
-        <tr class="status-{{ b.status }}" data-resource="{{ b.resource_id }}">
+        <tr class="status-{{ b.status }}" data-resource="{{ b.resource_id }}" data-location="{{ b.location_id }}">
           <td>{{ b.start_local.strftime('%H:%M') }}</td>
           <td>{{ b.customer_name }}</td>
           <td>{{ b.service }}</td>
@@ -135,8 +135,12 @@
       <div class="field">
         <label>Ressource</label>
         <select name="resource_id" required>
-          {% for r in resources %}
-          <option value="{{ r.resource_id }}">{{ r.name }}</option>
+          {% for loc in locations %}
+          <optgroup label="{{ loc.name }}">
+            {% for r in resources_by_location.get(loc.location_id, []) %}
+            <option value="{{ r.resource_id }}">{{ r.name }}</option>
+            {% endfor %}
+          </optgroup>
           {% endfor %}
         </select>
       </div>
@@ -174,7 +178,7 @@
     (function () {
       var RES_KEY = 'ownerAgendaFilialeFilter';
       var CANCELLED_KEY = 'ownerAgendaShowCancelled';
-      var checkboxes = document.querySelectorAll('.res-toggle');
+      var checkboxes = document.querySelectorAll('.loc-toggle');
       var showCancelledCb = document.getElementById('showCancelled');
       if (!checkboxes.length && !showCancelledCb) return;
 
@@ -197,9 +201,9 @@
         var showCancelled = !!(showCancelledCb && showCancelledCb.checked);
 
         document.querySelectorAll('table tbody tr[data-resource]').forEach(function (tr) {
-          var resOk = !checkboxes.length || active.indexOf(tr.getAttribute('data-resource')) !== -1;
+          var locOk = !checkboxes.length || active.indexOf(tr.getAttribute('data-location')) !== -1;
           var statusOk = showCancelled || !tr.classList.contains('status-cancelled');
-          tr.classList.toggle('res-hidden', !(resOk && statusOk));
+          tr.classList.toggle('res-hidden', !(locOk && statusOk));
         });
         document.querySelectorAll('.day').forEach(function (dayEl) {
           var table = dayEl.querySelector('table');