client_kym-booking

<!-- GSD:project-start source:PROJECT.md -->
## Project

**The Happy Cat — Booking System**

A booking, quote, and calendar-sync system for **The Happy Cat**, a UK cat-sitting sole trader (Kym).
Customers self-serve a booking request via a public form; the operator triages requests in an admin
dashboard; accepted bookings auto-sync to her iCloud calendar via CalDAV and trigger a customer
confirmation email with bank details and a calendar download. Built on Next.js 15 + Cloudflare
Workers (OpenNext) + D1 + Drizzle + iron-session + Resend + tsdav.

**Core Value:** The customer can submit a booking that lands in Kym's inbox and her iCloud calendar within seconds
of her tapping "Accept" — without her having to manage state, retype dates, or maintain a separate
spreadsheet. Everything else (CRM, settings, retention, audit) is in service of that primary loop.

### Constraints

- **Runtime**: Cloudflare Workers (OpenNext-adapted Next.js 15) — no Node-only APIs at runtime,
  PBKDF2 capped at 100k iterations.
- **Storage**: single Cloudflare D1 (SQLite). Drizzle migrations only.
- **Email**: Resend, single sender domain. No webhook/bounce handling.
- **Calendar**: Apple iCloud via tsdav (CalDAV, Basic auth with app-specific password).
- **Stack lock-in**: pnpm 10, Node 22 LTS. No server actions; every mutation is a REST POST
  under `src/app/api/`.
- **Auth model**: iron-session cookie + PBKDF2 + per-IP rate-limit + email-code 2FA. **No TOTP/
  authenticator-app 2FA** — explicitly declined by Kym during the walkthrough call.
- **Deploy boundary (until M3)**: All M2 work deploys to
…

## Key Abstractions
- Purpose: Represents a completed booking request with dates, visits, customer contact, and calendar sync status
- Examples: `src/lib/db/schema.ts` (bookings table), `src/lib/db/queries/bookings.ts` (getBookingById, updateBookingStatus)
- Pattern: Entity with denormalized customer fields (so booking is self-contained), plus FK to customers for dedup logic
- Purpose: Canonical customer record per email, shared across multiple bookings
- Examples: `src/lib/db/schema.ts` (customers table), `src/lib/db/queries/customers.ts` (upsertCustomerByEmail, mergeCustomers)
- Pattern: Canonical email as unique constraint, aliases array to track old emails after merge, merged_into_id for stub records
- Purpose: Encapsulate variable cost structure (base rate, two-visit rate, holiday multipliers)
- Examples: `src/lib/pricing/types.ts`, `src/lib/db/queries/pricing.ts`, `src/lib/pricing/calculate.ts`
- Pattern: Fetch config from DB once, pass through to calculatePrice(), which returns per-day breakdown
- Purpose: Map date → type ("school_holiday" or "bank_holiday") to apply multipliers
- Examples: `src/lib/db/schema.ts` (holiday_dates table), `src/lib/db/queries/holidays.ts` (listHolidays)
- Pattern: Bulk upload via CSV, or fetch UK holidays via external API
- Purpose: Opaque 24-byte hex string to authenticate public `/bookings/[token]/ics` endpoint without admin login
- Examples: `src/app/api/bookings/route.ts` (generateIcsToken), `src/app/(public)/bookings/[token]/ics/route.ts` (getBookingByIcsToken)
- Pattern: Token stored in bookings.ics_token, can be revoked (ics_revok…