Add Booking module: model, create/read/cancel API, Filament resource (T4.1-T4.7)

- Booking model with booking_vehicle_options line items (supports mixing
  vehicle options like front_seat + back_seat in one booking), price
  snapshot, status machine, and driver/car assignment fields
- BookingService: front-seat max, disabled-option toggles, duplicate-option
  and whole-vehicle-exclusivity guards
- CreateBookingAction, CancelBookingAction, AssignDriverAction
- BookingRefGenerator: sequential EVB-AAAAA1-style refs via row lock
- POST/GET/cancel booking API endpoints (Sanctum, ownership + admin policy)
- BookingPlugin + Filament BookingResource: list, detail view, Cancel and
  Assign Driver actions (shared between table and detail page)
- domain.md updated for multi-vehicle-option bookings (§2) and driver/
  vehicle assignment (§5a)

app-modules/booking/tests/Feature/BookingPolicyTest.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\User;
+use Modules\Booking\Models\Booking;
 use Modules\Booking\Policies\BookingPolicy;
 use Spatie\Permission\Models\Permission;
 
@@ -10,16 +11,37 @@ beforeEach(function () {
     }
 });
 
-test('viewAny and view require the view_bookings permission', function () {
+test('viewAny is open to any authenticated user — listing is scoped to their own bookings at the query level', function () {
     $policy = new BookingPolicy;
 
-    $withPermission = User::factory()->create()->givePermissionTo('view_bookings');
-    $withoutPermission = User::factory()->create();
+    expect($policy->viewAny(User::factory()->create()))->toBeTrue();
+});
 
-    expect($policy->viewAny($withPermission))->toBeTrue()
-        ->and($policy->view($withPermission, null))->toBeTrue()
-        ->and($policy->viewAny($withoutPermission))->toBeFalse()
-        ->and($policy->view($withoutPermission, null))->toBeFalse();
+test('view allows the booking\'s owner', function () {
+    $policy = new BookingPolicy;
+
+    $owner = User::factory()->create();
+    $booking = Booking::factory()->create(['user_id' => $owner->id]);
+
+    expect($policy->view($owner, $booking))->toBeTrue();
+});
+
+test('view rejects a non-owner without the view_bookings permission', function () {
+    $policy = new BookingPolicy;
+
+    $stranger = User::factory()->create();
+    $booking = Booking::factory()->create(['user_id' => User::factory()->create()->id]);
+
+    expect($policy->view($stranger, $booking))->toBeFalse();
+});
+
+test('view allows a non-owner with the view_bookings permission (admin/support)', function () {
+    $policy = new BookingPolicy;
+
+    $admin = User::factory()->create()->givePermissionTo('view_bookings');
+    $booking = Booking::factory()->create(['user_id' => User::factory()->create()->id]);
+
+    expect($policy->view($admin, $booking))->toBeTrue();
 });
 
 test('create is open to any authenticated user', function () {
@@ -28,14 +50,31 @@ test('create is open to any authenticated user', function () {
     expect($policy->create(User::factory()->create()))->toBeTrue();
 });
 
-test('cancel requires the manage_bookings permission', function () {
+test('cancel allows the booking\'s owner', function () {
     $policy = new BookingPolicy;
 
-    $withPermission = User::factory()->create()->givePermissionTo('manage_bookings');
-    $withoutPermission = User::factory()->create();
+    $owner = User::factory()->create();
+    $booking = Booking::factory()->create(['user_id' => $owner->id]);
 
-    expect($policy->cancel($withPermission, null))->toBeTrue()
-        ->and($policy->cancel($withoutPermission, null))->toBeFalse();
+    expect($policy->cancel($owner, $booking))->toBeTrue();
+});
+
+test('cancel allows staff with the manage_bookings permission on someone else\'s booking', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+    $booking = Booking::factory()->create(['user_id' => User::factory()->create()->id]);
+
+    expect($policy->cancel($staff, $booking))->toBeTrue();
+});
+
+test('cancel rejects a non-owner without the manage_bookings permission', function () {
+    $policy = new BookingPolicy;
+
+    $stranger = User::factory()->create();
+    $booking = Booking::factory()->create(['user_id' => User::factory()->create()->id]);
+
+    expect($policy->cancel($stranger, $booking))->toBeFalse();
 });
 
 test('refund requires the process_refunds permission', function () {