feat: add calendar booking page with email approval flow

[dddictionary]

Summary

• Adds /book page where visitors can request time on the calendar (name, email, subject, description, datetime, duration 15/30/60 min)
• Two-step approval flow: requester verifies their email → owner gets an approve/reject email → on approve, a Google Calendar event is created with the requester invited
• Spam protection: Cloudflare Turnstile, honeypot field, per-IP rate limit (5/hr), mandatory email verification, BOOKING_ENABLED kill switch

Before deploying

1. Run python scripts/google_oauth_setup.py locally with a client_secret.json from Google Cloud Console to obtain a refresh token
2. Create a Cloudflare Turnstile site + secret keys
3. Generate a Gmail App Password
4. Add the new env vars to the backend-secrets k8s Secret: BOOKING_TOKEN_SECRET, OWNER_EMAIL, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REFRESH_TOKEN, GOOGLE_CALENDAR_ID, TURNSTILE_SITE_KEY, TURNSTILE_SECRET, SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASSWORD, SMTP_FROM

Test plan

• Unit tests (15 new) cover happy path, honeypot, invalid input, rate limit, turnstile fail, kill switch, verify/decide flows — pytest tests/ is 32/32 passing
• Manual smoke test against staging once secrets are configured
• Confirm calendar invite arrives in requester's inbox and on owner's calendar
• Confirm reject path sends polite decline email