feat(export): CSV export for bookings and customers

GET /v1/export/bookings.csv (optional from/to bounds) and
/v1/export/customers.csv — UTF-8 with BOM for Excel, labels resolved
at export time, buffered responses so auth failures stay JSON.
Export buttons on the bookings and customers pages.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/openapi/bookra.openapi.yaml

@@ -1431,6 +1431,54 @@ paths:
                 $ref: "#/components/schemas/ActivityFeedResponse"
         "404":
           description: Tenant membership not found
+  /v1/export/bookings.csv:
+    get:
+      tags: [Export]
+      operationId: exportBookingsCsv
+      security:
+        - bearerAuth: []
+      summary: Export tenant bookings as CSV
+      description: >-
+        Full booking export for accounting and backup — UTF-8 with BOM so
+        Czech diacritics open correctly in Excel. Optional `from`/`to`
+        (YYYY-MM-DD) bounds the export window; `to` is inclusive.
+      parameters:
+        - name: from
+          in: query
+          schema:
+            type: string
+            format: date
+        - name: to
+          in: query
+          schema:
+            type: string
+            format: date
+      responses:
+        "200":
+          description: CSV file download
+          content:
+            text/csv:
+              schema:
+                type: string
+        "404":
+          description: Tenant membership not found
+  /v1/export/customers.csv:
+    get:
+      tags: [Export]
+      operationId: exportCustomersCsv
+      security:
+        - bearerAuth: []
+      summary: Export tenant customers as CSV
+      description: Full customer list export — UTF-8 with BOM for Excel.
+      responses:
+        "200":
+          description: CSV file download
+          content:
+            text/csv:
+              schema:
+                type: string
+        "404":
+          description: Tenant membership not found
   /v1/public/calendar/{token}:
     get:
       tags: [Calendar]