fix: resolve guest booking failures from router conflict, reservation self-block, and closed-day miscalculation

- backend/main.go: Flatten /bookings/* sub-Route to explicit paths to prevent
  RequireAuth middleware from bleeding into OptionalAuth POST /bookings
- backend/handlers/scheduling/time-blockers.go: Exclude RESERVATION:* entries
  from GetTimeBlockersInRange so overlap checks dont reject the users own
  reservation before CreateBookingHandler can delete it
- local-dev-2.sh: Fix open_day to skip Saturday (6) not Monday (1), matching
  working_hours schema; move guest booking dates to +16/+20/+22 days beyond
  the upcoming loop range; add reserve-then-book step mirroring frontend flow

backend/main.go

@@ -137,15 +137,16 @@ func main() {
 			})
 		})
 
-		// Public booking endpoints (optional auth for slot reservation)
-		r.With(mw.RateLimit(30, time.Minute), mw.OptionalAuth).Post("/bookings/reserve", bookings.ReserveSlotHandler)
+		// Public booking endpoints (optional auth for slot reservation and guest bookings)
+		r.Group(func(r chi.Router) {
+			r.Use(mw.RateLimit(30, time.Minute), mw.OptionalAuth)
+			r.Post("/bookings/reserve", bookings.ReserveSlotHandler)
+			r.Post("/bookings", bookings.CreateBookingHandler)
+		})
 
 		// Guest user creation (public, no auth required)
 		r.With(mw.RateLimit(10, time.Minute)).Post("/users/guest", user.CreateGuestUserHandler)
 
-		// Booking creation (accepts both authenticated and guest users)
-		r.With(mw.RateLimit(30, time.Minute), mw.OptionalAuth).Post("/bookings", bookings.CreateBookingHandler)
-
 		// Authenticated users
 		r.Group(func(r chi.Router) {
 			r.Use(mw.RequireAuth)
@@ -160,16 +161,13 @@ func main() {
 			r.Delete("/user/account", user.DeleteAccountHandler)
 			r.Get("/user/loyalty", user.GetLoyaltyHandler)
 
-			r.Route("/bookings", func(r chi.Router) {
-				r.Get("/", bookings.GetAllUserBookingsHandler)
-				r.Get("/{id}", bookings.GetBookingHandler)
-				r.Get("/{id}/calendar", bookings.GetBookingCalendarHandler)
-				r.Put("/{id}", bookings.EditBookingHandler)
-				r.Delete("/{id}", bookings.DeleteBookingHandler)
-				// Edit request endpoints
-				r.Post("/{id}/edit-request", bookings.RequestEditHandler)
-				r.Delete("/{id}/edit-request", bookings.DeleteEditRequestHandler)
-			})
+			r.Get("/bookings", bookings.GetAllUserBookingsHandler)
+			r.Get("/bookings/{id}", bookings.GetBookingHandler)
+			r.Get("/bookings/{id}/calendar", bookings.GetBookingCalendarHandler)
+			r.Put("/bookings/{id}", bookings.EditBookingHandler)
+			r.Delete("/bookings/{id}", bookings.DeleteBookingHandler)
+			r.Post("/bookings/{id}/edit-request", bookings.RequestEditHandler)
+			r.Delete("/bookings/{id}/edit-request", bookings.DeleteEditRequestHandler)
 		})
 
 		// Admin-only (no rate limit - trusted users with authenticated sessions)