Add Access group admin surfaces, booking soft deletes, refund crash fix

Access group (Filament):
- StaffResource: manage users with an admin-tier role, gated by manage_staff
- CustomerResource: read-only view of role-less users, gated by view_customers
- RoleResource: edit permissions per role (fixed role set), gated by manage_roles
- ManageAppSettings: tabbed General/Booking settings page that reads/writes
  real .env keys via new EnvFileWriter (no parallel DB settings table, so
  BookingService/config('booking.*') stay unchanged)
- Moved Access above Catalog in the nav group order
- New permissions: manage_staff, manage_roles, view_customers, manage_settings

Booking soft deletes:
- bookings.deleted_at + SoftDeletes on the Booking model
- BookingPolicy::delete (manage_bookings, cancelled/expired only) and
  ::restore (manage_bookings)
- DeleteBookingTableAction/RestoreBookingTableAction + TrashedFilter on
  BookingsTable, using authorize() so the policy is enforced at call time,
  not just cosmetically hidden

Refund crash fix:
- ProcessRefundAction passed a nullable $payment->booking into
  RefundBookingAction's non-nullable Booking param — a soft-deleted
  booking's payment reaching the refund picker was an uncaught TypeError.
  Excluded such payments from the picker and added a defensive guard.
- Same unguarded $event->payment->booking / $event->refund->payment->booking
  pattern fixed in the MarkBookingPaid/MarkBookingRefunded queued listeners.

289 tests passing.

app-modules/payment/src/Filament/Resources/Refunds/Actions/ProcessRefundAction.php

@@ -33,6 +33,10 @@ class ProcessRefundAction
                     ->label('Payment')
                     ->options(fn () => Payment::query()
                         ->where('status', PaymentStatus::Completed->value)
+                        // A soft-deleted booking excludes itself from this
+                        // belongsTo by default — never offer a payment whose
+                        // booking is gone (Booking now uses SoftDeletes).
+                        ->whereHas('booking')
                         ->with('booking')
                         ->get()
                         ->mapWithKeys(fn (Payment $payment) => [
@@ -50,6 +54,20 @@ class ProcessRefundAction
             ->action(function (array $data): void {
                 $payment = Payment::with('booking')->findOrFail($data['payment_id']);
 
+                // Defense in depth against the options list going stale
+                // between render and submit (e.g. the booking gets deleted
+                // mid-form) — $payment->booking is nullable, but
+                // RefundBookingAction requires a real Booking.
+                if ($payment->booking === null) {
+                    Notification::make()
+                        ->title('Refund failed')
+                        ->body('This payment\'s booking no longer exists.')
+                        ->danger()
+                        ->send();
+
+                    return;
+                }
+
                 try {
                     app(RefundBookingAction::class)->handle(
                         $payment->booking,

app-modules/payment/src/Listeners/MarkBookingPaid.php

@@ -18,6 +18,14 @@ class MarkBookingPaid implements ShouldQueue
     {
         $booking = $event->payment->booking;
 
+        // Booking uses SoftDeletes — normally unreachable here (a
+        // pending_payment booking is never deletable, BookingPolicy::delete),
+        // but this listener is queued, so it's worth guarding against a
+        // booking that vanished between dispatch and execution regardless.
+        if ($booking === null) {
+            return;
+        }
+
         if ($booking->status === BookingStatus::PendingPayment) {
             $booking->update(['status' => BookingStatus::Confirmed]);
         }

app-modules/payment/src/Listeners/MarkBookingRefunded.php

@@ -18,6 +18,14 @@ class MarkBookingRefunded implements ShouldQueue
     {
         $booking = $event->refund->payment->booking;
 
+        // Booking uses SoftDeletes — normally unreachable here (a confirmed
+        // booking is never deletable, BookingPolicy::delete), but this
+        // listener is queued, so it's worth guarding against a booking that
+        // vanished between dispatch and execution regardless.
+        if ($booking === null) {
+            return;
+        }
+
         if ($booking->status === BookingStatus::Confirmed) {
             $booking->update(['status' => BookingStatus::Cancelled]);
         }