feat(place/booking-notifier): email booking reminders before booking start (supersedes #637)

[KesterJJ]

Adds a bookings.booking_reminder template trigger to the booking notifier, plus a scheduled sweep that emails the booking owner ahead of a booking starting.

Reminders are configured as a list of offsets in minutes before the start (reminders_before_booking), checked on a cron sweep (reminder_schedule), because a cron entry alone cannot express "3 days before a booking that starts on an arbitrary day". A grace window (reminder_grace_minutes) stops a reminder going out late after downtime.

Behaviour

• Recipient is the booking owner (user_email), replies go to booked_by_email. A zone without notify_booking_owner: true gets no reminders.
• Skips bookings already checked in, bookings created after their reminder moment had passed, and reminders outside the grace window.
• Each reminder is sent once per booking - the sent state lives in the reminders_sent status, so a restart does not re-send.
• Queries bookings of the driver's booking_type (deploy one instance per type); for a visitor booking user_email is the host. With unique_templates: true the trigger becomes bookings.booking_reminder_<booking_type>.
• Zone attachments are resolved the way booking notifications do, honouring disable_attachments, and attachment_name / attachment_url are always offered as merge fields.
• The reminder trigger deliberately does not advertise network_username / network_password - a reminder must not rotate the credential the booking email already handed out.
• The sweep runs immediately when the driver starts or its settings change, then on the cron interval, so a restart cannot push a reminder past reminder_grace_minutes.

Testing

./harness report drivers/place/booking_notifier.cr and the drivers/place/* run both pass for this driver:

• a cron armed in settings sends the due reminder with no manual exec
• one booking inside two offsets receives two reminders, each carrying its own reminder_offset_minutes
• desk, visitor (host) and locker instances
• the fields advertised on the trigger equal the arguments actually sent, so no %{...} can survive into a concierge-authored template

Supersedes #637.