Add contract e-signature step with PDF viewer and canvas pad (issue #6)

Frontend (step 5):
- PDF.js 3.11.174 from CDN renders the contract inline in a scrollable viewer
- Next button logic stays unlocked; signature pad is visually locked (greyed +
  pointer-events:none) until user scrolls to the bottom of the contract
- HTML5 canvas signature pad with mouse and touch support; Clear button resets
- Typed full name field required to confirm identity
- Fallback agreement text renders if /api/contracts/template returns 404,
  auto-marks as scrolled — photographer adds PDF later with no code change

Backend:
- GET /api/contracts/template — serves api/contracts/model-release.pdf
- POST /api/bookings/:id/sign — stamps signature image + name/date/booking ID
  onto the PDF via pdf-lib, saves to api/signed-contracts/<id>.pdf, updates
  contract_signed_at and contract_pdf_path in the bookings table, fires n8n
  webhook; gracefully skips PDF stamping if template is missing
- submitBooking() now calls POST /api/bookings then POST /api/bookings/:id/sign
  sequentially before showing the success screen

Closes #6

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/package.json

@@ -10,6 +10,7 @@
     "better-sqlite3": "^9.4.3",
     "cors": "^2.8.5",
     "dotenv": "^16.4.5",
-    "express": "^4.18.3"
+    "express": "^4.18.3",
+    "pdf-lib": "^1.17.1"
   }
 }