Owner calendar view + manual booking + owner cancel/reschedule (#20)

Adds an owner-authenticated weekly agenda (grouped by day, today highlighted)
with manual walk-in/phone booking creation, cancel, and reschedule -- all
routed through booking_api.py's create/cancel/reschedule logic (refactored
into shared helpers) so the EXCLUDE overlap constraint and confirmation
email stay on the single existing code path. Manual creation can skip the
opening-hours/min-notice/max-advance/buffer checks via an explicit override,
but never the overlap constraint itself.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/booking_db.py

@@ -125,6 +125,18 @@ def list_active_resources(client_id):
     return _list_active("resources", client_id)
 
 
+def list_resources(client_id):
+    """All of client_id's resources, active or not -- unlike
+    list_active_resources, used where a name lookup must still resolve for a
+    booking made against a resource that's since been deactivated (the owner
+    agenda, #20)."""
+    with db.connect() as conn, conn.cursor() as cur:
+        cur.execute(
+            "SELECT * FROM resources WHERE client_id = %s ORDER BY name",
+            (client_id,))
+        return cur.fetchall()
+
+
 # ---- bookings ----
 
 _BOOKING_UPDATABLE = {"resource_id", "customer_name", "customer_contact",
@@ -182,6 +194,19 @@ def list_bookings(client_id):
         return cur.fetchall()
 
 
+def list_bookings_between(client_id, start, end):
+    """Every one of client_id's bookings (any resource, any status --
+    including cancelled, so the owner agenda (#20) can still show a
+    cancelled slot rather than silently dropping it) whose start_time falls
+    in [start, end)."""
+    with db.connect() as conn, conn.cursor() as cur:
+        cur.execute(
+            "SELECT * FROM bookings WHERE client_id = %s AND start_time >= %s "
+            "AND start_time < %s ORDER BY start_time",
+            (client_id, start, end))
+        return cur.fetchall()
+
+
 def list_active_bookings_for_resource(client_id, resource_id, start, end,
                                        exclude_booking_id=None):
     """Bookings on client_id's own resource_id, not cancelled, that fall