fix: move preview-available-hours to admin route group

Move GET /api/scheduling/preview-available-hours from public OptionalAuth group into the admin-only group (RequireAuth + RequireAdmin) since it's an admin simulation tool.

backend/main.go

@@ -320,6 +320,8 @@ func main() {
 				r.Use(mw.RequireAdmin)
 				r.Use(mw.RateLimit(60, time.Minute))
 
+				r.Get("/preview-available-hours", scheduling.GetPreviewAvailableHours)
+
 				r.Put("/default-hours", scheduling.UpdateDefaultHours)
 				r.Post("/exceptional-groups", scheduling.CreateExceptionalGroup)
 				r.Delete("/exceptional-groups", scheduling.DeleteExceptionalGroup)
@@ -429,6 +431,7 @@ func main() {
 				r.Get("/{id}/overlapping", bookings.GetOverlappingBookingsHandler)
 				r.Get("/overlapping", bookings.GetOverlappingBookingsByTimeHandler)
 				r.Get("/by-date-range", bookings.GetBookingsByDateRangeHandler)
+				r.Post("/conflicting-for-exception", scheduling.GetConflictingBookingsForExceptionHandler)
 				r.Get("/by-created-range", bookings.GetBookingsByCreatedRangeHandler)
 				r.Put("/{id}/reschedule", bookings.AdminRescheduleBookingHandler)
 				r.Put("/{id}/progress", bookings.ProgressBookingHandler)