Add locations (Filialen) as a grouping layer above resources

Enables multiple barbers/staff bookable at the same location and time
-- previously "resource" conflated "location" and "the thing that
can't double-book itself" into one row, so a Filiale could only ever
have exactly one bookable slot at once.

- New `locations` table; `resources.location_id` with a generic,
  idempotent backfill migration (any resource without a location gets
  one auto-created matching its name -- not a one-off for any single
  client, protects any future resource stuck in the old flat shape too)
- `resources`/`resource_hours`/services keep everything they already
  had (hours, min-notice, max-advance, buffer, the no-overlap
  constraint) scoped to resource_id, not location_id -- two barbers at
  one location must stay independently bookable at the same time
- booking_db.py: new locations CRUD mirroring the existing
  resources/services pattern; create_resource now requires a
  location_id, guarded the same way every other tenant check here is
  (get_location existence check, no real FK -- matches this schema's
  existing no-FK convention throughout)
- app.py: new POST /api/locations provisioning route; POST
  /api/resources now requires location_id
- owner_settings.py + settings.html: new self-service "add a Filiale"
  / "add a barber" UI -- there was previously no way to create a
  resource at all outside the CRM/n8n provisioning API
- public_booking.py + book.html: new Filiale picker (reuses the
  existing wireOptionGroup button-group pattern), filtering the
  Mitarbeiter picker to the selected location -- a single-location
  client sees no extra click, same as before Filialen existed
- owner_booking.py + agenda.html: the Filiale show/hide toggle and
  hide-cancelled toggle (shipped earlier this session) now key off
  location_id instead of resource_id, so hiding a Filiale hides every
  barber's bookings at it; manual-booking dropdown grouped by Filiale
- n8n/onboarding.json: default provisioning now creates a "Hauptfiliale"
  location before its resource (inert until re-imported into the live
  n8n instance)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/tests/test_public_booking.py

@@ -40,8 +40,9 @@ def _make_client(client_id=CLIENT_A, slug="happynails", business_name="Happy Nai
 
 def _setup_bookable_client(client_id=CLIENT_A, slug="happynails"):
     _make_client(client_id, slug)
-    resource = bdb.create_resource(client_id, "Chair 1", min_notice_minutes=0,
-                                    max_advance_days=365)
+    location = bdb.create_location(client_id, "Main")
+    resource = bdb.create_resource(client_id, location["location_id"], "Chair 1",
+                                    min_notice_minutes=0, max_advance_days=365)
     bdb.set_resource_hours(client_id, resource["resource_id"], 0, time(9, 0), time(17, 0))
     service = bdb.create_service(client_id, "Haircut", 60, price=25)
     return resource, service
@@ -64,7 +65,7 @@ def test_book_page_404s_for_unknown_slug(client):
 
 def test_book_page_404s_when_client_has_no_active_service(client):
     _make_client(CLIENT_B, slug="no-services-client")
-    bdb.create_resource(CLIENT_B, "Chair 1")
+    bdb.create_resource(CLIENT_B, bdb.create_location(CLIENT_B, "Main")["location_id"], "Chair 1")
     # No services created for this client.
     resp = client.get("/book/no-services-client")
     assert resp.status_code == 404
@@ -72,12 +73,33 @@ def test_book_page_404s_when_client_has_no_active_service(client):
 
 def test_book_page_404s_when_client_has_only_inactive_service(client):
     _make_client(CLIENT_B, slug="inactive-service-client")
-    bdb.create_resource(CLIENT_B, "Chair 1")
+    bdb.create_resource(CLIENT_B, bdb.create_location(CLIENT_B, "Main")["location_id"], "Chair 1")
     bdb.create_service(CLIENT_B, "Haircut", 60, active=False)
     resp = client.get("/book/inactive-service-client")
     assert resp.status_code == 404
 
 
+def test_book_page_includes_location_in_context(client):
+    resource, service = _setup_bookable_client()
+    resp = client.get("/book/happynails")
+    assert resp.status_code == 200
+    body = resp.get_data(as_text=True)
+    assert "LOCATIONS" in body
+    assert resource["location_id"] in body
+
+
+def test_book_page_404s_when_only_location_is_inactive(client):
+    """A resource whose Filiale was deactivated must not stay bookable even
+    though the resource row itself is still active."""
+    _make_client(CLIENT_B, slug="inactive-location-client")
+    location = bdb.create_location(CLIENT_B, "Main")
+    bdb.create_resource(CLIENT_B, location["location_id"], "Chair 1")
+    bdb.create_service(CLIENT_B, "Haircut", 60)
+    bdb.update_location(CLIENT_B, location["location_id"], active=False)
+    resp = client.get("/book/inactive-location-client")
+    assert resp.status_code == 404
+
+
 def test_honeypot_filled_silently_rejects_booking(client):
     resource, service = _setup_bookable_client()
     day = _next_monday(date.today())