M1: implement operational core

Demo auth, seed import/reset, dashboard, vehicle/booking list+detail, audit trail. Backend: 19 tests passing, ruff clean. Frontend: React Router shell, typed API client, responsive pages. Verified end-to-end via curl and browser.

backend/tests/test_bookings.py

@@ -0,0 +1,19 @@
+def test_list_bookings_filters_by_vehicle(ops_client):
+    response = ops_client.get("/api/v1/bookings", params={"vehicle_ref": "MO-024"})
+    assert response.status_code == 200
+    bookings = response.json()
+    assert len(bookings) >= 1
+    assert all(b["vehicle_ref"] == "MO-024" for b in bookings)
+
+
+def test_get_booking_detail(ops_client):
+    response = ops_client.get("/api/v1/bookings/BK-DEMO-RETURN")
+    assert response.status_code == 200
+    body = response.json()
+    assert body["status"] == "active"
+    assert body["vehicle_ref"] == "MO-024"
+
+
+def test_get_booking_404_for_unknown_ref(ops_client):
+    response = ops_client.get("/api/v1/bookings/BK-UNKNOWN")
+    assert response.status_code == 404