M39: harden application and acceptance gates

backend/app/api/routers/bookings.py

@@ -70,7 +70,9 @@ def list_bookings(
     if vehicle_ref:
         vehicle = db.scalar(select(Vehicle).where(Vehicle.public_ref == vehicle_ref))
         if vehicle is None:
-            return []
+            if page is None:
+                return []
+            return BookingPageOut(items=[], page=1, page_size=page_size, total=0, total_pages=1)
         stmt = stmt.where(Booking.vehicle_id == vehicle.id)
     if starts_from:
         stmt = stmt.where(Booking.ends_at >= starts_from)
@@ -445,8 +447,13 @@ def cancel_booking(
     booking = db.scalar(select(Booking).where(Booking.public_ref == public_ref).with_for_update())
     if booking is None:
         raise HTTPException(status_code=404, detail="Booking not found")
-    if booking.status != "reserved":
-        raise HTTPException(status_code=409, detail="Only a reserved booking can be cancelled")
+    if booking.status not in ("reserved", "blocked"):
+        # A booking blocked at checkout (damage, technical warning, ...) has no other exit:
+        # it never became active, so it can neither be returned nor completed. Cancelling
+        # it (audited, with a reason) is the only way to close the file.
+        raise HTTPException(
+            status_code=409, detail="Only a reserved or blocked booking can be cancelled"
+        )
     customer = db.get(Customer, booking.customer_id)
     vehicle = db.get(Vehicle, booking.vehicle_id)
     if customer is None or vehicle is None: