Rate-limit public bookings per contact; add direct owner contact endpoint

Public booking API now rejects a 6th active booking from the same
customer_contact within 24h (429), stopping one contact from filling
every slot on every resource, while owner-entered manual bookings stay
unaffected.

Add POST /api/contact: client sites can reach their own owner's inbox
directly (via their existing login email) for general inquiries,
separate from the agency's leads/Telegram pipeline (n8n/lead-intake.json),
which stays reserved for actual prospects contacting the agency itself.
Paris Barber Shop's contact form and Rückruf widget now point here; the
Rückruf floating widget itself has been removed from the site.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backoffice/app/app.py

@@ -18,6 +18,7 @@ import booking_db as bdb
 import db
 import owner_mail
 from booking_api import bp as booking_bp
+from contact_api import bp as contact_bp
 from public_booking import bp as public_booking_bp
 from manage_booking import bp as manage_booking_bp
 from owner_auth import bp as owner_auth_bp
@@ -31,6 +32,7 @@ app = Flask(__name__, static_folder="static", static_url_path="")
 # way to know the original request was HTTPS. One hop of proxy (Caddy).
 app.wsgi_app = ProxyFix(app.wsgi_app, x_proto=1, x_host=1)
 app.register_blueprint(booking_bp)
+app.register_blueprint(contact_bp)
 app.register_blueprint(public_booking_bp)
 app.register_blueprint(manage_booking_bp)
 app.register_blueprint(owner_auth_bp)