Separate user intent from planner output via day assertions

The calendar mixed two kinds of truth in one table. `planned_leave_day` was
simultaneously the allocator's output cache, the user's override store
(`is_pinned`, plus ad-hoc rows with no `wish_id`), and the resource ledger that
analytics and the age-4 maths read. The planner therefore had to ask "am I
allowed to touch this row?" on every sync, and got it wrong at the edges.

Every user assertion is now one `day_assertion` row — a concrete `day_type`
replaces a pinned day, a row with no `wish_id` replaces an ad-hoc day, and
`day_type='none'` replaces `planned_day_exclusion`. `planned_leave_day` becomes
purely derived with a single writer, and `PlanningService.pinned_keys()` is the
single answer to "is this day pinned", used by the allocator's loader, by
`sync_plan` and by the read router alike.

On top of that, every calendar band is now a real event: an ad-hoc band opens
the same full editor as a wish-backed one and saving it promotes it to a
`LeaveWish`, so it can be named, repeated yearly, assigned to either or both
parents, and handed to the planner. "Planering" is a `moveable` toggle plus a
from/to month bound plus a separate lock/unlock action on the days themselves,
replacing a three-rung ladder whose "planner decides" rung set a search window
equal to the drawn dates and so could never move anything.

Bugs found and fixed along the way:

- The plan erased its own history. Fixed windows clip to today, so an elapsed
  auto-placed day fell into `stale_keys` and was deleted on the next sync —
  and a background sync runs on every workspace load. Past rows are now frozen
  and counted as spent.
- Migration 010's downgrade silently destroyed every pinned day and exclusion
  (`is_pinned` returned as DEFAULT 0, the exclusion table came back empty,
  exit 0, no warning). It now reconstructs both from `day_assertion`, and 009
  itemises what it cannot recover before dropping the table.
- Deleting a period left its assertions behind, locking those dates forever
  with no UI path to clear them. Wish deletion now clears them by `wish_id`.
- `DayAssertionService` and `LeaveWishService` committed multi-statement writes
  without a transaction; a crash mid-write diverged the tables or half-deleted
  a series. Both now run in a unit of work.
- A sibling year's shortfall was never surfaced: the toast only inspected the
  edited occurrence's outcome, so a fully unfunded later year rendered as an
  empty band with no warning.
- A flexible window whose bound had entirely elapsed was dropped from the
  proposal with no outcome at all. It now reports as `unplaced`.
- Unlocking a period deleted its days instead of returning them to the planner.
- The e2e global setup posted to a route deleted in this change, which would
  have failed the whole suite before its first test.

Gates: backend 938 tests / 91% coverage, frontend 1351 / 97.4 | 92.2 | 94.37 |
97.4. Migrations 009 and 010 audited against a hand-built realistic database:
the upgrade reconciles exactly and a constraint violation fails safe, leaving
the schema at 008.

Not complete. Step 4's toggle, month picker and lock/unlock action are verified
by browser walk and unit tests, but the partial-lock readout was not exercised.
`ideas.md` §7 adds a full plan for the vacation-forfeiture defect (the planner
detects expiring days and then does nothing about them) — not implemented here.
Remaining smaller items are listed in the session's restructure notes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T4wjgbVL4HAC5Rdaw75VbV

backend/tests/unit/test_planning_service.py

@@ -64,14 +64,21 @@ class TestPlanningService:
         assert result.day_type == "vacation"
         assert result.is_dubbeldag is False
 
-    async def test_add_planned_day_with_wish_id_and_is_pinned(
+    async def test_add_planned_day_with_wish_id(
         self,
         planning_service: PlanningService,
         leave_wish_repo: SQLiteLeaveWishRepository,
         seeded_ids: SeededIds,
     ) -> None:
-        """Round-trips `wish_id`/`is_pinned` through the repository (create +
-        re-fetch), not just the in-memory object the create call returns."""
+        """Round-trips `wish_id` through the repository (create + re-fetch),
+
+        not just the in-memory object the create call returns. `is_pinned`
+        is no longer a `planned_leave_day` column (restructure step 3b) — a
+        freshly-added row is never pinned on its own; `PlanningService.
+        pinned_keys`/`is_pinned` compute that live from `DayAssertion`, see
+        `test_day_assertion.py` for that half of the guarantee this test
+        used to also cover.
+        """
         wish = await leave_wish_repo.create(
             _make_wish(seeded_ids.workspace_id, seeded_ids.child_id)
         )
@@ -83,14 +90,12 @@ class TestPlanningService:
             date=date(2026, 6, 15),
             day_type="vacation",
             wish_id=wish.id,
-            is_pinned=True,
         )
         assert result.wish_id == wish.id
-        assert result.is_pinned is True
+        assert await planning_service.is_pinned(result) is False
 
         fetched = await planning_service.get(result.id)
         assert fetched.wish_id == wish.id
-        assert fetched.is_pinned is True
 
     async def test_add_planned_day_without_wish_id_defaults_to_none(
         self,
@@ -105,7 +110,6 @@ class TestPlanningService:
             day_type="vacation",
         )
         assert result.wish_id is None
-        assert result.is_pinned is False
 
     async def test_add_double_booking_raises(
         self,
@@ -407,12 +411,17 @@ class TestPlanningService:
         assert updated.day_type == "sjukpenning"
         assert updated.is_dubbeldag is True
 
-    async def test_update_planned_day_wish_id_and_is_pinned(
+    async def test_update_planned_day_wish_id(
         self,
         planning_service: PlanningService,
         leave_wish_repo: SQLiteLeaveWishRepository,
         seeded_ids: SeededIds,
     ) -> None:
+        """`is_pinned` is not an `update()` parameter any more (restructure
+
+        step 3b) — see `add_planned_day`'s docstring. Pinning this row is
+        now `DayAssertionService.assert_day`'s job (`test_day_assertion.py`).
+        """
         wish = await leave_wish_repo.create(
             _make_wish(seeded_ids.workspace_id, seeded_ids.child_id)
         )
@@ -428,14 +437,73 @@ class TestPlanningService:
         updated = await planning_service.update(
             created.id,
             wish_id=wish.id,
-            is_pinned=True,
         )
         assert updated.wish_id == wish.id
-        assert updated.is_pinned is True
 
         refetched = await planning_service.get(created.id)
         assert refetched.wish_id == wish.id
-        assert refetched.is_pinned is True
+
+    async def test_update_omitted_wish_id_leaves_it_unchanged(
+        self,
+        planning_service: PlanningService,
+        leave_wish_repo: SQLiteLeaveWishRepository,
+        seeded_ids: SeededIds,
+    ) -> None:
+        """Regression: an OMITTED `wish_id` (the caller doesn't pass it at
+
+        all) must leave the row's existing wish attachment untouched — a
+        call that's only updating `day_type`, say, must not accidentally
+        detach the row from its wish.
+        """
+        wish = await leave_wish_repo.create(
+            _make_wish(seeded_ids.workspace_id, seeded_ids.child_id)
+        )
+        created = await planning_service.add_planned_day(
+            workspace_id=seeded_ids.workspace_id,
+            child_id=seeded_ids.child_id,
+            parent_personal_data_uuid=seeded_ids.personal_data_uuid,
+            date=date(2026, 6, 15),
+            day_type="vacation",
+        )
+        attached = await planning_service.update(created.id, wish_id=wish.id)
+        assert attached.wish_id == wish.id
+
+        updated = await planning_service.update(created.id, day_type="lagsta")
+        assert updated.day_type == "lagsta"
+        assert updated.wish_id == wish.id  # unchanged, not detached
+
+    async def test_update_explicit_none_detaches_wish_id(
+        self,
+        planning_service: PlanningService,
+        leave_wish_repo: SQLiteLeaveWishRepository,
+        seeded_ids: SeededIds,
+    ) -> None:
+        """Regression: an explicit `wish_id=None` (`_clear_wish_id=True`)
+
+        must actually detach the row from its wish, unlike a merely
+        OMITTED `wish_id` (see the sibling test above) — before the fix,
+        `if wish_id is not None: entity.wish_id = wish_id` silently ignored
+        both cases identically, so a day could never be detached through
+        `update()`.
+        """
+        wish = await leave_wish_repo.create(
+            _make_wish(seeded_ids.workspace_id, seeded_ids.child_id)
+        )
+        created = await planning_service.add_planned_day(
+            workspace_id=seeded_ids.workspace_id,
+            child_id=seeded_ids.child_id,
+            parent_personal_data_uuid=seeded_ids.personal_data_uuid,
+            date=date(2026, 6, 15),
+            day_type="vacation",
+        )
+        attached = await planning_service.update(created.id, wish_id=wish.id)
+        assert attached.wish_id == wish.id
+
+        detached = await planning_service.update(created.id, _clear_wish_id=True)
+        assert detached.wish_id is None
+
+        refetched = await planning_service.get(created.id)
+        assert refetched.wish_id is None
 
     async def test_update_missing_raises(
         self,