chore: add clickup http request file and credentials

clickup.http

@@ -0,0 +1,4 @@
+### list custom fields
+GET {{clickup_baseurl}}/list/{{clickup_list_id}}/field?include_applied_objects=true
+Authorization: {{clickup_api_token}}
+

http-client.env.json

@@ -41,7 +41,11 @@
           "Scope": "api"
         }
       }
-    }
+    },
+    "clickup_baseurl": "https://api.clickup.com/api/v2",
+    "clickup_api_token": "abcdef123456789",
+    "clickup_list_id": "12345",
+    "clickup_template_id": "t-12345"
   },
   "staging": {
     "Security": {
@@ -85,7 +89,11 @@
           "Scope": "api"
         }
       }
-    }
+    },
+    "clickup_baseurl": "https://api.clickup.com/api/v2",
+    "clickup_api_token": "abcdef123456789",
+    "clickup_list_id": "12345",
+    "clickup_template_id": "t-12345"
   },
   "prod": {
     "Security": {
@@ -129,6 +137,10 @@
           "Scope": "api"
         }
       }
-    }
+    },
+    "clickup_baseurl": "https://api.clickup.com/api/v2",
+    "clickup_api_token": "abcdef123456789",
+    "clickup_list_id": "12345",
+    "clickup_template_id": "t-12345"
   }
 }

src/Controller/Booking/Create/IndexController.php

@@ -48,6 +48,7 @@ class IndexController extends AbstractController
     #[Route(
         path: '/bookings/create',
         name: 'app_booking_create',
+        methods: ['GET'],
     )]
     public function index(#[MapQueryString] ?BookingQueryParams $params): Response
     {
@@ -70,10 +71,16 @@ class IndexController extends AbstractController
      * Optionally accepts an agency code parameter. If provided and valid, the
      * corresponding agency ID is stored in the booking. If not provided or invalid,
      * defaults to agency code '0001'.
+     *
+     * POST-only on purpose: this endpoint is neither safe nor idempotent. It resets the
+     * caller's booking session and forces an uncached BusPro availability call plus a CMS
+     * roundtrip, so it must not be reachable by anything that speculatively fetches URLs
+     * (prefetchers, link unfurlers, mail scanners, crawlers). The loading page posts to it.
      */
     #[Route(
         path: '/bookings/create/init',
         name: 'app_booking_create_init',
+        methods: ['POST'],
     )]
     public function init(Request $request, #[MapQueryString] ?BookingQueryParams $params): Response
     {

templates/booking/create/index.html.twig

@@ -2,7 +2,7 @@
 
 {% block content %}
     <div class="flex-1 flex items-center justify-center"
-         hx-get="{{ path('app_booking_create_init', {
+         hx-post="{{ path('app_booking_create_init', {
              date_id: params.dateId,
              hotel_id: params.hotelId,
              agency: params.agency,