feat(availability): per-staff working hours and class/session management

- Working-hours repo accepts nullable staff scope (pgx + memory); staff
  rules live in availability_rules and drive public slot generation
- Protected routes for staff working hours, class templates, and class
  sessions with tenant-ownership checks and input validation
- Sessions derive endsAt/capacity from templates; list resolves location
  names and live booked counts; template delete cascades sessions,
  session delete preserves bookings via SET NULL (mirrored in memory)
- Zones page: staff-scope selector on working hours, new Classes tab
  with template/session CRUD, CS+EN strings, mobile tab wrapping
- Normalize availability_rules times to HH:MM in the service layer

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/api/server.go

@@ -904,6 +904,140 @@ func NewServer(cfg config.Config, pools *db.Pools) (*Server, error) {
 		c.JSON(http.StatusOK, gin.H{"status": "updated"})
 	})
 
+	// Staff-scoped working hours (per-person availability rules)
+	protected.GET("/catalog/staff/:staffID/working-hours", func(c *gin.Context) {
+		response, err := catalogService.ListStaffWorkingHours(c.Request.Context(), auth.PrincipalFromContext(c), c.Param("staffID"))
+		if err != nil {
+			status := http.StatusInternalServerError
+			switch {
+			case errors.Is(err, catalog.ErrTenantMembership), errors.Is(err, catalog.ErrStaffNotFound):
+				status = http.StatusNotFound
+			}
+			c.JSON(status, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, response)
+	})
+	protected.PUT("/catalog/staff/:staffID/working-hours/:dayOfWeek", func(c *gin.Context) {
+		dayOfWeek, err := strconv.Atoi(c.Param("dayOfWeek"))
+		if err != nil || dayOfWeek < 0 || dayOfWeek > 6 {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_day_of_week"})
+			return
+		}
+		var request domain.UpdateWorkingHoursRequest
+		if err := c.ShouldBindJSON(&request); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_request"})
+			return
+		}
+		err = catalogService.UpdateStaffWorkingHours(c.Request.Context(), auth.PrincipalFromContext(c), c.Param("staffID"), dayOfWeek, request)
+		if err != nil {
+			status := http.StatusInternalServerError
+			switch {
+			case errors.Is(err, catalog.ErrTenantMembership), errors.Is(err, catalog.ErrStaffNotFound):
+				status = http.StatusNotFound
+			case errors.Is(err, catalog.ErrInvalidBooking):
+				status = http.StatusBadRequest
+			}
+			c.JSON(status, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"status": "updated"})
+	})
+
+	// ============================================
+	// CATALOG API - Classes
+	// ============================================
+	protected.GET("/catalog/class-templates", func(c *gin.Context) {
+		response, err := catalogService.ListClassTemplates(c.Request.Context(), auth.PrincipalFromContext(c))
+		if err != nil {
+			status := http.StatusInternalServerError
+			if errors.Is(err, catalog.ErrTenantMembership) {
+				status = http.StatusNotFound
+			}
+			c.JSON(status, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, response)
+	})
+	protected.POST("/catalog/class-templates", func(c *gin.Context) {
+		var request domain.UpsertClassTemplateRequest
+		if err := c.ShouldBindJSON(&request); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_request"})
+			return
+		}
+		response, err := catalogService.CreateClassTemplate(c.Request.Context(), auth.PrincipalFromContext(c), request)
+		if err != nil {
+			status := http.StatusInternalServerError
+			switch {
+			case errors.Is(err, catalog.ErrTenantMembership):
+				status = http.StatusNotFound
+			case errors.Is(err, catalog.ErrInvalidInput):
+				status = http.StatusBadRequest
+			}
+			c.JSON(status, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusCreated, response)
+	})
+	protected.DELETE("/catalog/class-templates/:templateID", func(c *gin.Context) {
+		err := catalogService.DeleteClassTemplate(c.Request.Context(), auth.PrincipalFromContext(c), c.Param("templateID"))
+		if err != nil {
+			status := http.StatusInternalServerError
+			switch {
+			case errors.Is(err, catalog.ErrTenantMembership), errors.Is(err, catalog.ErrClassTemplateNotFound):
+				status = http.StatusNotFound
+			}
+			c.JSON(status, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"status": "deleted"})
+	})
+	protected.GET("/catalog/class-sessions", func(c *gin.Context) {
+		response, err := catalogService.ListClassSessions(c.Request.Context(), auth.PrincipalFromContext(c))
+		if err != nil {
+			status := http.StatusInternalServerError
+			if errors.Is(err, catalog.ErrTenantMembership) {
+				status = http.StatusNotFound
+			}
+			c.JSON(status, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, response)
+	})
+	protected.POST("/catalog/class-sessions", func(c *gin.Context) {
+		var request domain.CreateClassSessionRequest
+		if err := c.ShouldBindJSON(&request); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid_request"})
+			return
+		}
+		response, err := catalogService.CreateClassSession(c.Request.Context(), auth.PrincipalFromContext(c), request)
+		if err != nil {
+			status := http.StatusInternalServerError
+			switch {
+			case errors.Is(err, catalog.ErrTenantMembership), errors.Is(err, catalog.ErrClassTemplateNotFound), errors.Is(err, catalog.ErrLocationNotFound):
+				status = http.StatusNotFound
+			case errors.Is(err, catalog.ErrInvalidInput):
+				status = http.StatusBadRequest
+			}
+			c.JSON(status, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusCreated, response)
+	})
+	protected.DELETE("/catalog/class-sessions/:sessionID", func(c *gin.Context) {
+		err := catalogService.DeleteClassSession(c.Request.Context(), auth.PrincipalFromContext(c), c.Param("sessionID"))
+		if err != nil {
+			status := http.StatusInternalServerError
+			switch {
+			case errors.Is(err, catalog.ErrTenantMembership), errors.Is(err, catalog.ErrClassSessionNotFound):
+				status = http.StatusNotFound
+			}
+			c.JSON(status, gin.H{"error": err.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"status": "deleted"})
+	})
+
 	// ============================================
 	// CUSTOMER BOOKING MANAGEMENT API (Public)
 	// ============================================