feat: make booking init flow entry-point post only

src/Controller/Booking/Create/IndexController.php

@@ -48,6 +48,7 @@ class IndexController extends AbstractController
     #[Route(
         path: '/bookings/create',
         name: 'app_booking_create',
+        methods: ['GET'],
     )]
     public function index(#[MapQueryString] ?BookingQueryParams $params): Response
     {
@@ -70,10 +71,16 @@ class IndexController extends AbstractController
      * Optionally accepts an agency code parameter. If provided and valid, the
      * corresponding agency ID is stored in the booking. If not provided or invalid,
      * defaults to agency code '0001'.
+     *
+     * POST-only on purpose: this endpoint is neither safe nor idempotent. It resets the
+     * caller's booking session and forces an uncached BusPro availability call plus a CMS
+     * roundtrip, so it must not be reachable by anything that speculatively fetches URLs
+     * (prefetchers, link unfurlers, mail scanners, crawlers). The loading page posts to it.
      */
     #[Route(
         path: '/bookings/create/init',
         name: 'app_booking_create_init',
+        methods: ['POST'],
     )]
     public function init(Request $request, #[MapQueryString] ?BookingQueryParams $params): Response
     {

templates/booking/create/index.html.twig

@@ -2,7 +2,7 @@
 
 {% block content %}
     <div class="flex-1 flex items-center justify-center"
-         hx-get="{{ path('app_booking_create_init', {
+         hx-post="{{ path('app_booking_create_init', {
              date_id: params.dateId,
              hotel_id: params.hotelId,
              agency: params.agency,