feat: add OptionalAuth middleware and slot reservation endpoint

OptionalAuth extracts user info from Bearer token if present,
otherwise passes through without requiring authentication.

ReserveSlotHandler creates temporary time_blockers reservations:
- Logged-in users: max 1 active, 1hr TTL, tracked by user_id
- Anonymous users: global cap of 50, 10min TTL, tracked by IP hash
- Validates slot availability (working hours, booking overlap, blocker overlap)
- Returns reservation ID, start_time, duration, and expires_at

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/mw/auth.go

@@ -40,6 +40,26 @@ func RequireAuth(next http.Handler) http.Handler {
 	})
 }
 
+// OptionalAuth middleware - extracts user info if token present, otherwise passes through
+func OptionalAuth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		authHeader := r.Header.Get("Authorization")
+		if authHeader != "" && strings.HasPrefix(authHeader, "Bearer ") {
+			tokenString := strings.TrimPrefix(authHeader, "Bearer ")
+
+			userID, role, err := auth.VerifyToken(tokenString, r.Context())
+			if err == nil {
+				ctx := context.WithValue(r.Context(), UserIDKey, userID)
+				ctx = context.WithValue(ctx, UserRoleKey, role)
+				next.ServeHTTP(w, r.WithContext(ctx))
+				return
+			}
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
 // RequireRole middleware - checks if user has required role(s)
 func RequireRole(allowedRoles ...string) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {