Add Access group admin surfaces, booking soft deletes, refund crash fix

Access group (Filament):
- StaffResource: manage users with an admin-tier role, gated by manage_staff
- CustomerResource: read-only view of role-less users, gated by view_customers
- RoleResource: edit permissions per role (fixed role set), gated by manage_roles
- ManageAppSettings: tabbed General/Booking settings page that reads/writes
  real .env keys via new EnvFileWriter (no parallel DB settings table, so
  BookingService/config('booking.*') stay unchanged)
- Moved Access above Catalog in the nav group order
- New permissions: manage_staff, manage_roles, view_customers, manage_settings

Booking soft deletes:
- bookings.deleted_at + SoftDeletes on the Booking model
- BookingPolicy::delete (manage_bookings, cancelled/expired only) and
  ::restore (manage_bookings)
- DeleteBookingTableAction/RestoreBookingTableAction + TrashedFilter on
  BookingsTable, using authorize() so the policy is enforced at call time,
  not just cosmetically hidden

Refund crash fix:
- ProcessRefundAction passed a nullable $payment->booking into
  RefundBookingAction's non-nullable Booking param — a soft-deleted
  booking's payment reaching the refund picker was an uncaught TypeError.
  Excluded such payments from the picker and added a defensive guard.
- Same unguarded $event->payment->booking / $event->refund->payment->booking
  pattern fixed in the MarkBookingPaid/MarkBookingRefunded queued listeners.

289 tests passing.

app-modules/booking/tests/Feature/BookingPolicyTest.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\User;
+use Modules\Booking\Enums\BookingStatus;
 use Modules\Booking\Models\Booking;
 use Modules\Booking\Policies\BookingPolicy;
 use Spatie\Permission\Models\Permission;
@@ -86,3 +87,53 @@ test('refund requires the process_refunds permission', function () {
     expect($policy->refund($withPermission, null))->toBeTrue()
         ->and($policy->refund($withoutPermission, null))->toBeFalse();
 });
+
+test('delete allows staff with manage_bookings on a cancelled booking', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+    $booking = Booking::factory()->create(['status' => BookingStatus::Cancelled]);
+
+    expect($policy->delete($staff, $booking))->toBeTrue();
+});
+
+test('delete allows staff with manage_bookings on an expired booking', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+    $booking = Booking::factory()->create(['status' => BookingStatus::Expired]);
+
+    expect($policy->delete($staff, $booking))->toBeTrue();
+});
+
+test('delete rejects a pending_payment or confirmed booking even with manage_bookings', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+
+    $pending = Booking::factory()->create(['status' => BookingStatus::PendingPayment]);
+    $confirmed = Booking::factory()->create(['status' => BookingStatus::Confirmed]);
+
+    expect($policy->delete($staff, $pending))->toBeFalse()
+        ->and($policy->delete($staff, $confirmed))->toBeFalse();
+});
+
+test('delete rejects a cancelled booking without manage_bookings, even for the owner', function () {
+    $policy = new BookingPolicy;
+
+    $owner = User::factory()->create();
+    $booking = Booking::factory()->create(['user_id' => $owner->id, 'status' => BookingStatus::Cancelled]);
+
+    expect($policy->delete($owner, $booking))->toBeFalse();
+});
+
+test('restore requires the manage_bookings permission', function () {
+    $policy = new BookingPolicy;
+
+    $staff = User::factory()->create()->givePermissionTo('manage_bookings');
+    $stranger = User::factory()->create();
+    $booking = Booking::factory()->create();
+
+    expect($policy->restore($staff, $booking))->toBeTrue()
+        ->and($policy->restore($stranger, $booking))->toBeFalse();
+});