Add multi-guest management: per-booking roster, docs, guest autocomplete

- Migration 010: booking_guests table (roster per booking with passport data)
- Backend: /bookings/:id/guests CRUD — auto-links/creates guest profiles by passport
- Backend: /hotel-settings GET/PATCH for key-value settings (require_guest_docs)
- BookingDetailPanel: Гости tab with multi-guest list, inline add/edit form,
  guest autocomplete (debounced search in guests table), child/main badges,
  passport fields for adults, scan stub, require-docs warning
- SettingsPage: toggle "Обязательное заполнение документов гостей"
- Pass slug prop through CalendarPage → BookingCalendar → BookingDetailPanel

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/routes/hotel-settings.ts

@@ -0,0 +1,66 @@
+import { FastifyPluginAsync } from 'fastify'
+import { db } from '../db'
+
+type SlugParam = { Params: { slug: string } }
+
+const hotelSettings: FastifyPluginAsync = async (fastify) => {
+  const getHotelId = async (slug: string): Promise<string | null> => {
+    const { rows } = await db.query('SELECT id FROM hotels WHERE slug = $1', [slug])
+    return rows[0]?.id ?? null
+  }
+
+  const canAccess = (userSlug: string | null, role: string, slug: string) =>
+    role === 'super_admin' || userSlug === slug
+
+  // ── GET /api/hotels/:slug/hotel-settings ─────────────────────────────────
+  fastify.get<SlugParam>(
+    '/api/hotels/:slug/hotel-settings',
+    { onRequest: [fastify.authenticate] },
+    async (request, reply) => {
+      const { slug } = request.params
+      if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
+        return reply.code(403).send({ error: 'Forbidden' })
+      }
+      const hotelId = await getHotelId(slug)
+      if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
+
+      const { rows } = await db.query(
+        'SELECT key, value FROM hotel_settings WHERE hotel_id = $1',
+        [hotelId],
+      )
+      const out: Record<string, unknown> = {}
+      for (const row of rows) {
+        out[row.key] = row.value
+      }
+      return out
+    },
+  )
+
+  // ── PATCH /api/hotels/:slug/hotel-settings ───────────────────────────────
+  fastify.patch<SlugParam & { Body: Record<string, unknown> }>(
+    '/api/hotels/:slug/hotel-settings',
+    { onRequest: [fastify.authenticate] },
+    async (request, reply) => {
+      const { slug } = request.params
+      if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
+        return reply.code(403).send({ error: 'Forbidden' })
+      }
+      const hotelId = await getHotelId(slug)
+      if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
+
+      const updates = request.body
+      for (const [key, value] of Object.entries(updates)) {
+        await db.query(
+          `INSERT INTO hotel_settings (hotel_id, key, value, updated_at)
+           VALUES ($1, $2, $3::jsonb, NOW())
+           ON CONFLICT (hotel_id, key) DO UPDATE
+             SET value = EXCLUDED.value, updated_at = NOW()`,
+          [hotelId, key, JSON.stringify(value)],
+        )
+      }
+      return { ok: true }
+    },
+  )
+}
+
+export default hotelSettings