Public booking page + iframe embed (#17)

Adds the customer-facing /book/<slug> page: service/slot picker, booking
form, and confirmation screen, built on #16's existing booking JSON API.
Includes iframe auto-fit height reporting (mirroring
deploy/booking/booking_layout.js's eaBookingHeight message), brand-color
theming via a ?color= query param, a honeypot field with a fake-success
response indistinguishable from a real booking, and a clear "just taken"
message on slot-conflict. Caddy per-IP rate limiting is documented in
deploy/booking/RATE_LIMIT.md for manual application (no Caddyfile is
tracked in this repo).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/booking/RATE_LIMIT.md

@@ -0,0 +1,34 @@
+# Caddy rate limiting for `/book/*` and `/api/booking/*` (#17)
+
+Like every other homelab Caddy change (see `deploy/clients/new-client.sh`), there's no
+Caddyfile tracked in this repo -- apply this by hand at `/etc/caddy/Caddyfile` on the host
+and reload with `docker exec caddy caddy reload --config /etc/caddy/Caddyfile`.
+
+Add, on the site block that proxies to `smb-crm` (e.g. `onboard.mivanchenko.de`, or wherever
+`/book/` and `/api/booking/` are routed):
+
+```
+handle /book/* {
+    rate_limit {
+        zone book_public {
+            key {remote_host}
+            events 20
+            window 1m
+        }
+    }
+    reverse_proxy smb-crm:8080
+}
+handle /api/booking/* {
+    rate_limit {
+        zone book_api {
+            key {remote_host}
+            events 30
+            window 1m
+        }
+    }
+    reverse_proxy smb-crm:8080
+}
+```
+
+Requires Caddy built with the `caddy-ratelimit` plugin, as used for other per-IP
+protections on this homelab.