Add locations (Filialen) as a grouping layer above resources

Enables multiple barbers/staff bookable at the same location and time
-- previously "resource" conflated "location" and "the thing that
can't double-book itself" into one row, so a Filiale could only ever
have exactly one bookable slot at once.

- New `locations` table; `resources.location_id` with a generic,
  idempotent backfill migration (any resource without a location gets
  one auto-created matching its name -- not a one-off for any single
  client, protects any future resource stuck in the old flat shape too)
- `resources`/`resource_hours`/services keep everything they already
  had (hours, min-notice, max-advance, buffer, the no-overlap
  constraint) scoped to resource_id, not location_id -- two barbers at
  one location must stay independently bookable at the same time
- booking_db.py: new locations CRUD mirroring the existing
  resources/services pattern; create_resource now requires a
  location_id, guarded the same way every other tenant check here is
  (get_location existence check, no real FK -- matches this schema's
  existing no-FK convention throughout)
- app.py: new POST /api/locations provisioning route; POST
  /api/resources now requires location_id
- owner_settings.py + settings.html: new self-service "add a Filiale"
  / "add a barber" UI -- there was previously no way to create a
  resource at all outside the CRM/n8n provisioning API
- public_booking.py + book.html: new Filiale picker (reuses the
  existing wireOptionGroup button-group pattern), filtering the
  Mitarbeiter picker to the selected location -- a single-location
  client sees no extra click, same as before Filialen existed
- owner_booking.py + agenda.html: the Filiale show/hide toggle and
  hide-cancelled toggle (shipped earlier this session) now key off
  location_id instead of resource_id, so hiding a Filiale hides every
  barber's bookings at it; manual-booking dropdown grouped by Filiale
- n8n/onboarding.json: default provisioning now creates a "Hauptfiliale"
  location before its resource (inert until re-imported into the live
  n8n instance)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/tests/test_provisioning.py

@@ -40,6 +40,28 @@ def test_create_client_persists_slug(client):
     assert bdb.get_client_by_slug("slug-test-abcd")["client_id"] == client_id
 
 
+# ---- /api/locations ----
+
+def test_create_location_requires_crm_token(client):
+    resp = client.post("/api/locations", json={"client_id": CLIENT_A, "name": "Hauptfiliale"})
+    assert resp.status_code == 403
+
+
+def test_create_location_creates_row(client):
+    _insert_client(CLIENT_A)
+    resp = client.post("/api/locations", headers=AUTH,
+                        json={"client_id": CLIENT_A, "name": "Hauptfiliale"})
+    assert resp.status_code == 201
+    location_id = resp.get_json()["location_id"]
+    assert bdb.get_location(CLIENT_A, location_id)["name"] == "Hauptfiliale"
+
+
+def test_create_location_requires_name(client):
+    _insert_client(CLIENT_A)
+    resp = client.post("/api/locations", headers=AUTH, json={"client_id": CLIENT_A})
+    assert resp.status_code == 400
+
+
 # ---- /api/resources ----
 
 def test_create_resource_requires_crm_token(client):
@@ -49,8 +71,9 @@ def test_create_resource_requires_crm_token(client):
 
 def test_create_resource_sets_hours(client):
     _insert_client(CLIENT_A)
+    location = bdb.create_location(CLIENT_A, "Hauptfiliale")
     resp = client.post("/api/resources", headers=AUTH, json={
-        "client_id": CLIENT_A, "name": "Hauptressource",
+        "client_id": CLIENT_A, "location_id": location["location_id"], "name": "Hauptressource",
         "hours": [{"weekday": 0, "opens_at": "09:00", "closes_at": "18:00"}]})
     assert resp.status_code == 201
     resource_id = resp.get_json()["resource_id"]
@@ -60,10 +83,26 @@ def test_create_resource_sets_hours(client):
 
 def test_create_resource_requires_name(client):
     _insert_client(CLIENT_A)
-    resp = client.post("/api/resources", headers=AUTH, json={"client_id": CLIENT_A})
+    location = bdb.create_location(CLIENT_A, "Hauptfiliale")
+    resp = client.post("/api/resources", headers=AUTH,
+                        json={"client_id": CLIENT_A, "location_id": location["location_id"]})
     assert resp.status_code == 400
 
 
+def test_create_resource_requires_location_id(client):
+    _insert_client(CLIENT_A)
+    resp = client.post("/api/resources", headers=AUTH,
+                        json={"client_id": CLIENT_A, "name": "Hauptressource"})
+    assert resp.status_code == 400
+
+
+def test_create_resource_rejects_unknown_location(client):
+    _insert_client(CLIENT_A)
+    resp = client.post("/api/resources", headers=AUTH, json={
+        "client_id": CLIENT_A, "location_id": "LOC-does-not-exist", "name": "Hauptressource"})
+    assert resp.status_code == 404
+
+
 # ---- /api/services ----
 
 def test_create_service_requires_crm_token(client):