feat(scheduling): dezky Scheduling — Calendly-style booking on Stalwart calendars

First-party booking system on top of Stalwart calendars (no third-party
scheduling dependency). Hosts expose public booking pages; visitors pick a
slot computed from the host's live Stalwart free/busy, and confirming writes
the event to the host's calendar and sends a dezky-branded confirmation with
an .ics.

platform-api (services/platform-api/src/scheduling):
- Schemas: Host, StalwartCredential (AES-256-GCM at rest), AvailabilitySchedule,
  EventType, Booking, SlotLock (unique (hostId,startUtc) + TTL).
- StalwartCalendarModule: JMAP gateway (free/busy via Principal/getAvailability,
  event create/delete, scheduleAgent=client) + on-behalf app-password
  provisioning. CredentialCipher for at-rest encryption.
- DST-correct slot engine (Luxon) with unit tests; two-layer double-booking
  guard (atomic SlotLock + live free/busy re-check).
- Booking confirm/cancel/reschedule, branded email + .ics via JMAP submission,
  self-service manage tokens. /api/v1 public + tenant-gated admin routes,
  per-IP rate limiting.

apps/booking: standalone public, whitelabel booking app (booking.dezky.eu) —
path-based tenant resolution, per-tenant brand colour, booking + manage flows.

apps/portal: admin scheduling page (hosts, event types, availability, bookings
with edit/delete + admin cancel/reschedule) and proxy routes.

infra: booking dev service in docker-compose; scheduling env vars.

apps/booking/server/api/public/[tenantSlug]/[hostSlug]/[eventTypeSlug]/bookings.post.ts

@@ -0,0 +1,7 @@
+export default defineEventHandler(async (event) => {
+  const tenantSlug = getRouterParam(event, 'tenantSlug')!
+  const hostSlug = getRouterParam(event, 'hostSlug')!
+  const eventTypeSlug = getRouterParam(event, 'eventTypeSlug')!
+  const body = await readBody(event)
+  return forward(event, 'POST', `/api/v1/public/${seg(tenantSlug)}/${seg(hostSlug)}/${seg(eventTypeSlug)}/bookings`, { body })
+})

apps/booking/server/api/public/[tenantSlug]/[hostSlug]/[eventTypeSlug]/holds.post.ts

@@ -0,0 +1,7 @@
+export default defineEventHandler(async (event) => {
+  const tenantSlug = getRouterParam(event, 'tenantSlug')!
+  const hostSlug = getRouterParam(event, 'hostSlug')!
+  const eventTypeSlug = getRouterParam(event, 'eventTypeSlug')!
+  const body = await readBody(event)
+  return forward(event, 'POST', `/api/v1/public/${seg(tenantSlug)}/${seg(hostSlug)}/${seg(eventTypeSlug)}/holds`, { body })
+})

apps/booking/server/api/public/[tenantSlug]/[hostSlug]/[eventTypeSlug]/index.get.ts

@@ -0,0 +1,6 @@
+export default defineEventHandler(async (event) => {
+  const tenantSlug = getRouterParam(event, 'tenantSlug')!
+  const hostSlug = getRouterParam(event, 'hostSlug')!
+  const eventTypeSlug = getRouterParam(event, 'eventTypeSlug')!
+  return forward(event, 'GET', `/api/v1/public/${seg(tenantSlug)}/${seg(hostSlug)}/${seg(eventTypeSlug)}`)
+})

apps/booking/server/api/public/[tenantSlug]/[hostSlug]/[eventTypeSlug]/slots.get.ts

@@ -0,0 +1,7 @@
+export default defineEventHandler(async (event) => {
+  const tenantSlug = getRouterParam(event, 'tenantSlug')!
+  const hostSlug = getRouterParam(event, 'hostSlug')!
+  const eventTypeSlug = getRouterParam(event, 'eventTypeSlug')!
+  const query = getQuery(event)
+  return forward(event, 'GET', `/api/v1/public/${seg(tenantSlug)}/${seg(hostSlug)}/${seg(eventTypeSlug)}/slots`, { query })
+})

apps/booking/server/api/public/bookings/[token]/cancel.post.ts

@@ -0,0 +1,5 @@
+export default defineEventHandler(async (event) => {
+  const token = getRouterParam(event, 'token')!
+  const body = await readBody(event).catch(() => ({}))
+  return forward(event, 'POST', `/api/v1/public/bookings/${seg(token)}/cancel`, { body })
+})

apps/booking/server/api/public/bookings/[token]/index.get.ts

@@ -0,0 +1,4 @@
+export default defineEventHandler(async (event) => {
+  const token = getRouterParam(event, 'token')!
+  return forward(event, 'GET', `/api/v1/public/bookings/${seg(token)}`)
+})

apps/booking/server/api/public/bookings/[token]/reschedule.post.ts

@@ -0,0 +1,5 @@
+export default defineEventHandler(async (event) => {
+  const token = getRouterParam(event, 'token')!
+  const body = await readBody(event)
+  return forward(event, 'POST', `/api/v1/public/bookings/${seg(token)}/reschedule`, { body })
+})