Scheduling: real availability + booking via Cal.com

SHIPPED and live-proven 2026-06-24: slot picker backed by Cal.com v2 /slots, server-side booking with attendee + timezone (real booking uid captured, confirmation emailed, then canceled). Concurrency-safe idempotency added 2026-07-03 (WS-11): unique indexes close the double-submit and cross-contact slot races, per-contact future-booking cap. Remaining (tracked on per-firm accounts + hardening cards): inbound webhook capture at deploy, reschedule UI, "slot just taken" error copy.