feat(booking): multi-resource holds and confirmation with a database-level guarantee

Section 11 and the third closing rule of the design document: preventing a double
booking is the database's job, not the code's. Any "is it free?" check in PHP has a
race window between the read and the write — two concurrent requests both see free
and both write.

MariaDB has no range EXCLUDE constraint, so every occupied interval is broken into
fixed five-minute buckets under UNIQUE(resource_id, bucket_at, seat). The code only
INSERTs; a rejection from the database *is* the answer. `seat` carries capacity: a
three-bed room has seats 0..2, allocation walks upward on each collision, and the
fourth concurrent hold finds nowhere to sit. Counting capacity in PHP would have
rebuilt the very race this removes.

Buckets are written through DBAL rather than the ORM on purpose: a unique violation
raised inside flush() closes the EntityManager, and the next seat attempt would then
fail with "EntityManager is closed", hiding the real outcome.

Occupancy is one row per (segment × resource). The reference test asserts the payoff
directly: for a 55-minute appointment of numbing / waiting / laser, the room gets
three rows and the operator only two — the operator holds nothing during the wait and
stays bookable for someone else.

A partial hold never survives. If the second resource has no room, the first is
released and the hold itself removed; otherwise a resource stays locked for an
appointment that will never exist.

Confirming does not re-reserve anything — the seats were taken at hold time and only
the label changes. Re-reserving on confirm would reopen the race the hold closed.
Cancelling marks rows `released` instead of deleting them, because the history of
which resource was busy when is the input to the utilisation reports; the uniqueness
buckets *are* deleted, or that interval would stay locked forever.

Expired holds are released by the existing scheduler rather than a new one. That
exposed a bug in my own change: the flush guard used $count, which now includes
released holds, so reset([]) could pass false to save(). It is guarded on $expired.

The appointment itself is still built with the existing constructor, so
active_slot_key, events and the payment path behave exactly as before — the
multi-resource occupancy sits beside them, not instead of them.

12 tests. Two matter most: the second hold on the same resource and interval getting
409, and a test that writes a duplicate bucket row over a *separate connection* and
expects the unique-key violation — if that one ever passes silently, the guarantee
had moved back into the code.

1208 tests / 3495 assertions. phpstan at its 14-error baseline. Frozen slot contract
green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/Shared/Constant/ErrorCodes.php

@@ -25,6 +25,12 @@ class ErrorCodes
     /** این اندپوینت با روش نوبت‌دهی فعلیِ آن محل سازگار نیست. */
     public const ERR_WRONG_BOOKING_MODE = 'ERR_WRONG_BOOKING_MODE';
 
+    /** منبع در آن بازه ظرفیت خالی ندارد — از قید یکتای دیتابیس می‌آید، نه از بررسی کد. */
+    public const ERR_SLOT_TAKEN = 'ERR_SLOT_TAKEN';
+
+    /** مهلت رزرو موقت گذشته است. */
+    public const ERR_HOLD_EXPIRED = 'ERR_HOLD_EXPIRED';
+
     // Conflict
     public const ERR_CONFLICT_001 = 'ERR_CONFLICT_001';
 
@@ -138,6 +144,8 @@ class ErrorCodes
             self::ERR_NOT_FOUND_001   => 'منبع درخواستی یافت نشد',
             self::ERR_NO_ELIGIBLE_RESOURCE => 'برای این خدمت منبع واجد شرایطی در این شعبه نیست',
             self::ERR_WRONG_BOOKING_MODE   => 'این عملیات با روش نوبت‌دهی این محل سازگار نیست',
+            self::ERR_SLOT_TAKEN           => 'این زمان هم‌اکنون رزرو شد',
+            self::ERR_HOLD_EXPIRED         => 'مهلت رزرو موقت تمام شده است',
             self::ERR_FORBIDDEN_001   => 'دسترسی به این منبع مجاز نیست',
             self::ERR_PAYMENT_001     => 'درگاه پرداخت در دسترس نیست',
             self::ERR_PAYMENT_002     => 'مبلغ پرداخت نامعتبر است',

src/Shared/Tenant/GlobalTables.php

@@ -90,6 +90,9 @@ final class GlobalTables
     public const AGGREGATE_CHILDREN = [
         \App\Appointment\Entity\AppointmentEvent::class => \App\Appointment\Entity\Appointment::class,
         \App\Appointment\Plan\Entity\SegmentRequirement::class => \App\Appointment\Plan\Entity\SegmentTemplate::class,
+        \App\Appointment\Booking\Entity\AppointmentSegment::class => \App\Appointment\Entity\Appointment::class,
+        // سطل‌ها فقط قیدِ یکتاییِ ردیف اشغال‌اند و هیچ‌وقت مستقیم پرس‌وجو نمی‌شوند.
+        \App\Appointment\Booking\Entity\OccupancyBucket::class => \App\Appointment\Availability\Entity\ResourceOccupancy::class,
 
         // ریشه‌هاشان خودشان جفت محیط دارند (برخلاف پروندهٔ branch_working_hours در
         // تسک ۰۱)، پس ارث‌بری اینجا واقعی است. هیچ‌کدام uuid از request نمی‌گیرند: