feat: add admin views, a booking horizon and confirmation modals

Co-Authored-By: Claude Opus 5 <[email protected]>

config/packages/security.yaml

@@ -27,6 +27,9 @@ security:
         - { path: ^/(login|auth|logout)$, roles: PUBLIC_ACCESS }
         - { path: ^/auth/, roles: PUBLIC_ACCESS }
         - { path: ^/dev/, roles: PUBLIC_ACCESS }
+        # Before the catch-all, or ROLE_EMPLOYEE would match ^/ first and the admin area would be
+        # open to everybody. Order is the whole guard here.
+        - { path: ^/admin, roles: ROLE_ADMIN }
         # Either role opens the app -- access_control treats a list of roles as an OR. Not
         # ROLE_USER: myep authenticates far more people than work here, and someone who holds
         # neither of these is refused at login with an explanation rather than let in to an