Add Venmo payment step with QR code and configurable username (issue #7)

Step reorder (still 7 steps): Info (5) → Contract (6) → Payment (7)
- Client info moved to step 5 so it's available for the contract signature
  name and the personalised Venmo note before the payment step
- Contract is now step 6 (initContractStep triggered on step 6 entry)
- Step 7 is the full payment step — no separate confirm step needed

Payment step (step 7):
- Compact summary table: date, session type, length, location
- Large price display from siteConfig.booking.pricing
- "Pay on Venmo" button linking to:
  https://venmo.com/<username>?txn=pay&amount=<price>&note=<encoded-note>
  Note format: "LisiLou Booking - [SessionType] on [Date]"
- QR code rendered from GET /api/venmo-qr?url=<encoded> (server-side SVG
  via qrcode package, site colours applied)
- "I've sent payment" checkbox gates the Submit button
- Clicking Submit creates booking with payment_status='pending_confirmation',
  then signs the contract — success screen shown immediately

Configuration: venmoUsername lives in config/site.json under
booking.venmoUsername — change it there to point at any Venmo account with
no code change and no rebuild.

API additions:
- GET /api/venmo-qr?url= — validates url starts with venmo.com, returns SVG
- POST /api/bookings now accepts payment_status field

Closes #7

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/server.js

@@ -33,6 +33,7 @@ app.post('/api/bookings', (req, res) => {
   const {
     client_name, client_email, client_phone, client_sub,
     session_date, session_type, session_length, location,
+    payment_status,
   } = req.body;
 
   if (!client_email || !session_date || !session_type || !session_length) {
@@ -41,13 +42,37 @@ app.post('/api/bookings', (req, res) => {
 
   const result = db.prepare(`
     INSERT INTO bookings
-      (client_name, client_email, client_phone, client_sub, session_date, session_type, session_length, location)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-  `).run(client_name, client_email, client_phone, client_sub, session_date, session_type, session_length, location);
+      (client_name, client_email, client_phone, client_sub, session_date, session_type, session_length, location, payment_status)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(
+    client_name, client_email, client_phone, client_sub,
+    session_date, session_type, session_length, location,
+    payment_status || 'pending',
+  );
 
   res.status(201).json({ id: result.lastInsertRowid });
 });
 
+// Generate a QR code SVG for any URL — used by the Venmo payment step.
+// Venmo username and amount come from the frontend (which reads site.json),
+// so changing venmoUsername in config updates both the button and QR with
+// no server restart needed.
+app.get('/api/venmo-qr', async (req, res) => {
+  const { url } = req.query;
+  if (!url || !url.startsWith('https://venmo.com/')) {
+    return res.status(400).json({ error: 'url must be a venmo.com URL' });
+  }
+  try {
+    const QRCode = require('qrcode');
+    const svg = await QRCode.toString(url, { type: 'svg', margin: 2, width: 220, color: { dark: '#2C2C2C', light: '#FDFBF9' } });
+    res.setHeader('Content-Type', 'image/svg+xml');
+    res.setHeader('Cache-Control', 'public, max-age=3600');
+    res.send(svg);
+  } catch (err) {
+    res.status(500).json({ error: 'QR generation failed' });
+  }
+});
+
 // Stamp the signature onto the contract PDF and record it
 app.post('/api/bookings/:id/sign', async (req, res) => {
   const id = parseInt(req.params.id, 10);