feat: add email verification, profile pictures, deposits, and calendar

export
Backend:
- Add email verification code generation and verification endpoints
- Add profile picture upload with S3 storage and image processing
- Add deposit_required field to users with 48h advance booking
  requirement
- Add loyalty stamps that accumulate on completed bookings
- Auto-transition bookings: confirmed → in_progress → completed
- Add booking cancellation handler with no-show detection
- Add ICS calendar file download endpoint for bookings
- Sync bookings to CalDAV on confirmation
  Frontend:
- Add schedule page route
- Add avatar and image-cropper UI components
- Update shadcn-svelte components (button, dialog)
- Add "Add to Calendar" button in booking modal
  Database:
- Add verification_codes table
- Add profile_pic_url, loyalty_stamps, deposits_required to users
- Various schema updates

README.md

@@ -174,6 +174,10 @@ docker compose exec backend sh
 | Portfolio System | ✅ | ✅ | S3/R2 storage abstraction, tag-based filtering, category filters, admin upload, ?img= featured image param |
 | Service Eligibility | ✅ | ✅ | Age + patch test filtering; `/api/services/eligible-for/{user_id}` for admin booking flows |
 | Image Metadata Stripping | ✅ | ❌ | EXIF/GPS stripped on upload via `imaging` library |
+| Profile Pictures | ✅ | ✅ | Upload to separate bucket, cropper, circular display, CalDAV sync |
+| Auto-Booking Status | ✅ | ✅ | Auto-transition: confirmed → in_progress → completed based on time |
+| Simplified Deposits | ✅ | ❌ | `deposits_required` INT on users table (3 default), reduces on payment |
+| Contact Page | ✅ | ✅ | Dynamic data from first admin user via `/api/contact` endpoint |
 
 ### ⚠️ Partially Complete
 
@@ -196,7 +200,6 @@ docker compose exec backend sh
 | Location | Issue | Priority |
 |----------|-------|----------|
 | `BookingFlow.svelte:600` | `submitBooking()` only logs, needs POST implementation | High |
-| `BookingCreateModal.svelte:224` | Remove `console.log(users)` debug statement | Low |
 | `/api/users/guest` | Guest endpoint for walk-ins not implemented | Medium |
 | GDPR Export | Need endpoint for `export_all_user_data()` | Medium |
 | Tax Export | Endpoint for VAT return data export | Medium |