Add Google Calendar availability date picker (issue #3)

- api/google-calendar.js: service account JWT auth + freebusy query
  using only Node.js built-in crypto (no new npm deps). In-memory cache:
  5-min busy dates, 1-hr OAuth token. Gracefully returns empty busy list
  when GOOGLE_CALENDAR_ID / GOOGLE_SERVICE_ACCOUNT_JSON not configured.
- api/server.js: GET /api/availability?year=YYYY&month=MM endpoint
  with 5-min Cache-Control; errors return { busy:[], configured:false }
  so the UI always works even if Calendar is unavailable.
- src/index.html: replace plain <input type="date"> in step 1 with a
  custom month-grid calendar (dpInit/dpRender/dpNav/dpSelectDate).
  Hidden #session-date input carries the value for the rest of the wizard.
  Past dates and busy dates are visually blocked; month nav pre-fetches.
- tests/booking.spec.js: 4 new calendar UI tests + updated openAndPickDate
  helper to click a rendered day cell.
- tests/api.spec.js: 2 new availability endpoint tests.

Setup: set GOOGLE_CALENDAR_ID and GOOGLE_SERVICE_ACCOUNT_JSON in api/.env.
See api/google-calendar.js header for step-by-step instructions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/api.spec.js

@@ -62,6 +62,24 @@ test.describe('Booking API — public routes', () => {
     // Either 404 (no template uploaded) or 200 (uploaded) — both are valid; just not 500
     expect(res.status()).not.toBe(500);
   });
+
+  test('GET /api/availability returns busy array for valid month', async ({ request }) => {
+    const now = new Date();
+    const res = await request.get(`/api/availability?year=${now.getFullYear()}&month=${now.getMonth() + 1}`);
+    expect(res.status()).toBe(200);
+    const json = await res.json();
+    expect(Array.isArray(json.busy)).toBe(true);
+    expect(typeof json.configured).toBe('boolean');
+    // Each busy entry must be a valid YYYY-MM-DD string
+    for (const d of json.busy) {
+      expect(d).toMatch(/^\d{4}-\d{2}-\d{2}$/);
+    }
+  });
+
+  test('GET /api/availability rejects missing params', async ({ request }) => {
+    const res = await request.get('/api/availability');
+    expect(res.status()).toBe(400);
+  });
 });
 
 test.describe('Admin API — authentication', () => {