chore: configure env-based DAV_ADMIN_PASSWORD and add security headers

Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/bookings/manage.go

@@ -1583,6 +1583,8 @@ func AdminApproveEditRequestHandler(w http.ResponseWriter, r *http.Request) {
 
 	// Build update query for bookings table
 	if newStartTime != nil || notes != nil {
+	// setClauses contains only hardcoded column name assignments ("start_time = $N", "notes = $N").
+	// Column names are never derived from user input. User values are in args and always parameterised.
 		var setClauses []string
 		var args []interface{}
 		argNum := 1