feat(bookings): dashboard cancellation and waitlist promotion

- POST /v1/catalog/bookings/{id}/cancel lets businesses cancel
  tenant-owned bookings; two-step confirm in the detail modal
- Shared PromoteWaitlist helper promotes earliest waitlisted bookings
  when a class seat frees, on both dashboard and customer cancel paths;
  promoted customers get a confirmation email, waitlist ledger marked
  resolved
- waitlisted status surfaced in bookings UI: stats card, filter, warning
  badge, demo seed, CS+EN strings
- BookingRecord gains created_at for fair ordering; GetBookingByID and
  ResolveWaitlistEntry added to the repository surface

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/bookings/customer_service.go

@@ -26,6 +26,7 @@ type CustomerService struct {
 }
 
 type CustomerNotifier interface {
+	SendBookingConfirmation(ctx context.Context, data notifications.BookingEmailData) error
 	SendBookingReschedule(ctx context.Context, data notifications.BookingEmailData) error
 	SendBookingCancellation(ctx context.Context, data notifications.BookingEmailData) error
 }
@@ -42,6 +43,10 @@ func NewCustomerService(repo db.Repository, notifier CustomerNotifier, frontendU
 
 type customerNoopNotifier struct{}
 
+func (n *customerNoopNotifier) SendBookingConfirmation(ctx context.Context, data notifications.BookingEmailData) error {
+	return nil
+}
+
 func (n *customerNoopNotifier) SendBookingReschedule(ctx context.Context, data notifications.BookingEmailData) error {
 	return nil
 }
@@ -194,6 +199,15 @@ func (s *CustomerService) CancelBooking(ctx context.Context, reference string, t
 	// Send cancellation email (async)
 	go s.sendCancellationEmail(booking)
 
+	// A freed class seat promotes the earliest waitlisted booking.
+	if booking.ClassSessionID != nil {
+		if promoted, err := PromoteWaitlist(ctx, s.repo, booking.TenantID, *booking.ClassSessionID); err == nil {
+			for _, promotedBooking := range promoted {
+				go s.sendPromotionEmail(promotedBooking)
+			}
+		}
+	}
+
 	return nil
 }
 
@@ -270,3 +284,37 @@ func (s *CustomerService) sendCancellationEmail(booking db.BookingRecord) {
 
 	s.notifier.SendBookingCancellation(ctx, emailData)
 }
+
+// sendPromotionEmail confirms a booking that moved off the class waitlist.
+func (s *CustomerService) sendPromotionEmail(booking db.BookingRecord) {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	tenant, err := s.repo.GetTenantByID(ctx, booking.TenantID)
+	if err != nil {
+		return
+	}
+	brand, _ := s.repo.GetBrandProfile(ctx, tenant.ID)
+	brandColor := brand.PrimaryColor
+	if brandColor == "" {
+		brandColor = "#a65c3e"
+	}
+	serviceName, locationName := s.descriptors(ctx, booking)
+
+	s.notifier.SendBookingConfirmation(ctx, notifications.BookingEmailData{
+		TenantID:      tenant.ID,
+		TenantName:    tenant.Name,
+		TenantSlug:    tenant.Slug,
+		BrandColor:    brandColor,
+		CustomerName:  booking.CustomerName,
+		CustomerEmail: booking.CustomerEmail,
+		Service:       serviceName,
+		Location:      locationName,
+		Reference:     booking.Reference,
+		StartsAt:      booking.StartsAt,
+		EndsAt:        booking.EndsAt,
+		Timezone:      tenant.Timezone,
+		Locale:        tenant.Locale,
+		ManagementURL: s.managementURL(booking),
+	})
+}

apps/backend/internal/bookings/lifecycle.go

@@ -0,0 +1,64 @@
+package bookings
+
+import (
+	"context"
+	"errors"
+	"sort"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+
+	"bookra/apps/backend/internal/db"
+)
+
+// PromoteWaitlist confirms the earliest waitlisted bookings on a class session
+// while free capacity remains. It returns the promoted records so callers can
+// notify customers. A missing session is treated as nothing to promote.
+func PromoteWaitlist(ctx context.Context, repo db.Repository, tenantID, sessionID string) ([]db.BookingRecord, error) {
+	session, err := repo.GetClassSessionByID(ctx, sessionID)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	bookings, err := repo.ListBookingsByTenantBetween(ctx, tenantID, session.StartsAt.Add(-time.Second), session.EndsAt.Add(time.Second))
+	if err != nil {
+		return nil, err
+	}
+
+	confirmed := 0
+	var waitlisted []db.BookingRecord
+	for _, booking := range bookings {
+		if booking.ClassSessionID == nil || *booking.ClassSessionID != sessionID {
+			continue
+		}
+		switch booking.Status {
+		case "confirmed":
+			confirmed++
+		case "waitlisted":
+			waitlisted = append(waitlisted, booking)
+		}
+	}
+	if len(waitlisted) == 0 {
+		return nil, nil
+	}
+	sort.SliceStable(waitlisted, func(i, j int) bool {
+		return waitlisted[i].CreatedAt.Before(waitlisted[j].CreatedAt)
+	})
+
+	var promoted []db.BookingRecord
+	for _, booking := range waitlisted {
+		if session.Capacity > 0 && confirmed >= int(session.Capacity) {
+			break
+		}
+		if err := repo.UpdateBookingStatus(ctx, booking.ID, "confirmed"); err != nil {
+			return promoted, err
+		}
+		_ = repo.ResolveWaitlistEntry(ctx, tenantID, sessionID, booking.CustomerEmail)
+		confirmed++
+		promoted = append(promoted, booking)
+	}
+	return promoted, nil
+}

apps/backend/internal/bookings/service_test.go

@@ -3,6 +3,8 @@ package bookings
 import (
 	"context"
 	"errors"
+	"fmt"
+	"net/url"
 	"testing"
 	"time"
 
@@ -399,3 +401,52 @@ func TestCreateAppointmentRejectsForeignStaff(t *testing.T) {
 		t.Fatalf("expected ErrInvalidBooking, got %v", err)
 	}
 }
+
+func TestCustomerCancelPromotesWaitlist(t *testing.T) {
+	repo := db.NewMemoryRepository()
+	service := NewService(repo, nil, "http://localhost:3000")
+	customerService := NewCustomerService(repo, nil, "http://localhost:3000")
+	ctx := context.Background()
+
+	session, err := repo.GetClassSessionByID(ctx, "4bf74c12-44dd-45ca-86bb-b104f16f2435")
+	if err != nil {
+		t.Fatalf("get session: %v", err)
+	}
+	sessionID := session.ID
+	book := func(email string) domain.CreateBookingResponse {
+		resp, err := service.Create(ctx, domain.CreateBookingRequest{
+			TenantSlug:     "studio-atelier",
+			BookingMode:    "class",
+			ClassSessionID: &sessionID,
+			CustomerName:   "Test User",
+			CustomerEmail:  email,
+			StartsAt:       session.StartsAt.UTC().Format(time.RFC3339),
+			EndsAt:         session.EndsAt.UTC().Format(time.RFC3339),
+		})
+		if err != nil {
+			t.Fatalf("book %s: %v", email, err)
+		}
+		return resp
+	}
+
+	var confirmed []domain.CreateBookingResponse
+	for i := 0; i < 4; i++ {
+		confirmed = append(confirmed, book(fmt.Sprintf("seat%[email protected]", i)))
+	}
+	waiter := book("[email protected]")
+	if waiter.Status != "waitlisted" {
+		t.Fatalf("expected waitlisted, got %s", waiter.Status)
+	}
+
+	// Customer cancels a confirmed seat via the management token.
+	manageURL, _ := url.Parse(confirmed[0].ManageURL)
+	token := manageURL.Query().Get("token")
+	if err := customerService.CancelBooking(ctx, confirmed[0].Reference, token); err != nil {
+		t.Fatalf("customer cancel: %v", err)
+	}
+
+	booking, _ := repo.GetBookingByID(ctx, waiter.BookingID)
+	if booking.Status != "confirmed" {
+		t.Fatalf("expected waiter promoted to confirmed, got %q", booking.Status)
+	}
+}