Add Google Calendar availability date picker (issue #3)

- api/google-calendar.js: service account JWT auth + freebusy query
  using only Node.js built-in crypto (no new npm deps). In-memory cache:
  5-min busy dates, 1-hr OAuth token. Gracefully returns empty busy list
  when GOOGLE_CALENDAR_ID / GOOGLE_SERVICE_ACCOUNT_JSON not configured.
- api/server.js: GET /api/availability?year=YYYY&month=MM endpoint
  with 5-min Cache-Control; errors return { busy:[], configured:false }
  so the UI always works even if Calendar is unavailable.
- src/index.html: replace plain <input type="date"> in step 1 with a
  custom month-grid calendar (dpInit/dpRender/dpNav/dpSelectDate).
  Hidden #session-date input carries the value for the rest of the wizard.
  Past dates and busy dates are visually blocked; month nav pre-fetches.
- tests/booking.spec.js: 4 new calendar UI tests + updated openAndPickDate
  helper to click a rendered day cell.
- tests/api.spec.js: 2 new availability endpoint tests.

Setup: set GOOGLE_CALENDAR_ID and GOOGLE_SERVICE_ACCOUNT_JSON in api/.env.
See api/google-calendar.js header for step-by-step instructions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/server.js

@@ -4,6 +4,7 @@ const cors = require('cors');
 const fs = require('fs');
 const path = require('path');
 const db = require('./db');
+const { getBusyDates } = require('./google-calendar');
 
 const app = express();
 const PORT = process.env.PORT || 3001;
@@ -48,6 +49,25 @@ app.get('/api/health', (req, res) => {
   res.json({ ok: true });
 });
 
+// Availability — returns busy dates for a given month from Google Calendar.
+// Gracefully returns an empty busy list when Calendar is not configured.
+app.get('/api/availability', async (req, res) => {
+  const year  = parseInt(req.query.year,  10);
+  const month = parseInt(req.query.month, 10);
+  if (!year || !month || month < 1 || month > 12) {
+    return res.status(400).json({ error: 'year and month (1-12) are required' });
+  }
+  try {
+    const result = await getBusyDates(year, month);
+    res.setHeader('Cache-Control', 'public, max-age=300'); // 5-min CDN cache
+    res.json(result);
+  } catch (err) {
+    console.error('[availability]', err.message);
+    // Don't expose internal error; return empty so the UI can still function
+    res.json({ busy: [], configured: false, error: 'calendar_unavailable' });
+  }
+});
+
 // Serve the contract template PDF to the frontend PDF.js viewer
 app.get('/api/contracts/template', (req, res) => {
   const contractPath = path.join(CONTRACTS_DIR, 'model-release.pdf');