Add locations (Filialen) as a grouping layer above resources

Enables multiple barbers/staff bookable at the same location and time
-- previously "resource" conflated "location" and "the thing that
can't double-book itself" into one row, so a Filiale could only ever
have exactly one bookable slot at once.

- New `locations` table; `resources.location_id` with a generic,
  idempotent backfill migration (any resource without a location gets
  one auto-created matching its name -- not a one-off for any single
  client, protects any future resource stuck in the old flat shape too)
- `resources`/`resource_hours`/services keep everything they already
  had (hours, min-notice, max-advance, buffer, the no-overlap
  constraint) scoped to resource_id, not location_id -- two barbers at
  one location must stay independently bookable at the same time
- booking_db.py: new locations CRUD mirroring the existing
  resources/services pattern; create_resource now requires a
  location_id, guarded the same way every other tenant check here is
  (get_location existence check, no real FK -- matches this schema's
  existing no-FK convention throughout)
- app.py: new POST /api/locations provisioning route; POST
  /api/resources now requires location_id
- owner_settings.py + settings.html: new self-service "add a Filiale"
  / "add a barber" UI -- there was previously no way to create a
  resource at all outside the CRM/n8n provisioning API
- public_booking.py + book.html: new Filiale picker (reuses the
  existing wireOptionGroup button-group pattern), filtering the
  Mitarbeiter picker to the selected location -- a single-location
  client sees no extra click, same as before Filialen existed
- owner_booking.py + agenda.html: the Filiale show/hide toggle and
  hide-cancelled toggle (shipped earlier this session) now key off
  location_id instead of resource_id, so hiding a Filiale hides every
  barber's bookings at it; manual-booking dropdown grouped by Filiale
- n8n/onboarding.json: default provisioning now creates a "Hauptfiliale"
  location before its resource (inert until re-imported into the live
  n8n instance)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/tests/test_owner_settings.py

@@ -30,7 +30,8 @@ def _setup(client_id=CLIENT_A, **resource_kwargs):
             "notify_channel = EXCLUDED.notify_channel",
             (client_id, "Europe/Berlin", True, None))
         conn.commit()
-    resource = bdb.create_resource(client_id, "Chair 1", **resource_kwargs)
+    location = bdb.create_location(client_id, "Main")
+    resource = bdb.create_resource(client_id, location["location_id"], "Chair 1", **resource_kwargs)
     service = bdb.create_service(client_id, "Haircut", 60, price=25)
     return resource, service
 
@@ -110,7 +111,8 @@ def test_owner_can_update_resource_notice_and_buffer(client):
     resource, service = _setup(CLIENT_A)
     _login(client, CLIENT_A)
     resp = client.post(f"/owner/settings/resources/{resource['resource_id']}", data={
-        "min_notice_minutes": "120", "max_advance_days": "14", "buffer_minutes": "15"})
+        "name": "Chair 1", "min_notice_minutes": "120", "max_advance_days": "14",
+        "buffer_minutes": "15"})
     assert "error" not in resp.headers["Location"]
     updated = bdb.get_resource(CLIENT_A, resource["resource_id"])
     assert updated["min_notice_minutes"] == 120
@@ -118,11 +120,38 @@ def test_owner_can_update_resource_notice_and_buffer(client):
     assert updated["buffer_minutes"] == 15
 
 
+def test_owner_can_rename_resource_and_toggle_active(client):
+    resource, service = _setup(CLIENT_A)
+    _login(client, CLIENT_A)
+    resp = client.post(f"/owner/settings/resources/{resource['resource_id']}", data={
+        "name": "Anna", "min_notice_minutes": "60", "max_advance_days": "30",
+        "buffer_minutes": "0"})
+    assert "error" not in resp.headers["Location"]
+    updated = bdb.get_resource(CLIENT_A, resource["resource_id"])
+    assert updated["name"] == "Anna"
+    assert updated["active"] is False  # checkbox omitted == unchecked
+
+    resp = client.post(f"/owner/settings/resources/{resource['resource_id']}", data={
+        "name": "Anna", "active": "on", "min_notice_minutes": "60",
+        "max_advance_days": "30", "buffer_minutes": "0"})
+    assert bdb.get_resource(CLIENT_A, resource["resource_id"])["active"] is True
+
+
+def test_update_resource_rejects_missing_name(client):
+    resource, service = _setup(CLIENT_A)
+    _login(client, CLIENT_A)
+    resp = client.post(f"/owner/settings/resources/{resource['resource_id']}", data={
+        "name": "", "min_notice_minutes": "0", "max_advance_days": "14",
+        "buffer_minutes": "15"})
+    assert "error=invalid_resource" in resp.headers["Location"]
+
+
 def test_update_resource_rejects_negative_values(client):
     resource, service = _setup(CLIENT_A)
     _login(client, CLIENT_A)
     resp = client.post(f"/owner/settings/resources/{resource['resource_id']}", data={
-        "min_notice_minutes": "-1", "max_advance_days": "14", "buffer_minutes": "15"})
+        "name": "Chair 1", "min_notice_minutes": "-1", "max_advance_days": "14",
+        "buffer_minutes": "15"})
     assert "error=invalid_resource" in resp.headers["Location"]
 
 
@@ -131,11 +160,54 @@ def test_owner_cannot_update_another_tenants_resource(client):
     _setup(CLIENT_A)
     _login(client, CLIENT_A)
     resp = client.post(f"/owner/settings/resources/{resource_b['resource_id']}", data={
-        "min_notice_minutes": "0", "max_advance_days": "1", "buffer_minutes": "0"})
+        "name": "Hijacked", "min_notice_minutes": "0", "max_advance_days": "1",
+        "buffer_minutes": "0"})
     assert "error=not_found" in resp.headers["Location"]
     assert bdb.get_resource(CLIENT_B, resource_b["resource_id"])["max_advance_days"] != 1
 
 
+# ---- locations / resources self-service ----
+
+def test_owner_can_create_location(client):
+    _setup(CLIENT_A)
+    _login(client, CLIENT_A)
+    resp = client.post("/owner/settings/locations", data={"name": "Zweite Filiale"})
+    assert "error" not in resp.headers["Location"]
+    names = {l["name"] for l in bdb.list_locations(CLIENT_A)}
+    assert "Zweite Filiale" in names
+
+
+def test_create_location_rejects_missing_name(client):
+    _setup(CLIENT_A)
+    _login(client, CLIENT_A)
+    resp = client.post("/owner/settings/locations", data={"name": ""})
+    assert "error=invalid_location" in resp.headers["Location"]
+
+
+def test_owner_can_add_a_second_barber_to_a_location(client):
+    resource, service = _setup(CLIENT_A)
+    _login(client, CLIENT_A)
+    location_id = resource["location_id"]
+    resp = client.post("/owner/settings/resources", data={
+        "location_id": location_id, "name": "Jonas"})
+    assert "error" not in resp.headers["Location"]
+    names = {r["name"] for r in bdb.list_resources(CLIENT_A)}
+    assert {"Chair 1", "Jonas"} <= names
+    jonas = [r for r in bdb.list_resources(CLIENT_A) if r["name"] == "Jonas"][0]
+    assert jonas["location_id"] == location_id
+
+
+def test_create_resource_rejects_another_tenants_location(client):
+    resource_b, service_b = _setup(CLIENT_B)
+    _setup(CLIENT_A)
+    _login(client, CLIENT_A)
+    resp = client.post("/owner/settings/resources", data={
+        "location_id": resource_b["location_id"], "name": "Hijacked"})
+    assert "error=invalid_resource" in resp.headers["Location"]
+    names = {r["name"] for r in bdb.list_resources(CLIENT_B)}
+    assert "Hijacked" not in names
+
+
 def test_owner_can_set_opening_hours(client):
     resource, service = _setup(CLIENT_A)
     _login(client, CLIENT_A)