Separate user intent from planner output via day assertions

The calendar mixed two kinds of truth in one table. `planned_leave_day` was
simultaneously the allocator's output cache, the user's override store
(`is_pinned`, plus ad-hoc rows with no `wish_id`), and the resource ledger that
analytics and the age-4 maths read. The planner therefore had to ask "am I
allowed to touch this row?" on every sync, and got it wrong at the edges.

Every user assertion is now one `day_assertion` row — a concrete `day_type`
replaces a pinned day, a row with no `wish_id` replaces an ad-hoc day, and
`day_type='none'` replaces `planned_day_exclusion`. `planned_leave_day` becomes
purely derived with a single writer, and `PlanningService.pinned_keys()` is the
single answer to "is this day pinned", used by the allocator's loader, by
`sync_plan` and by the read router alike.

On top of that, every calendar band is now a real event: an ad-hoc band opens
the same full editor as a wish-backed one and saving it promotes it to a
`LeaveWish`, so it can be named, repeated yearly, assigned to either or both
parents, and handed to the planner. "Planering" is a `moveable` toggle plus a
from/to month bound plus a separate lock/unlock action on the days themselves,
replacing a three-rung ladder whose "planner decides" rung set a search window
equal to the drawn dates and so could never move anything.

Bugs found and fixed along the way:

- The plan erased its own history. Fixed windows clip to today, so an elapsed
  auto-placed day fell into `stale_keys` and was deleted on the next sync —
  and a background sync runs on every workspace load. Past rows are now frozen
  and counted as spent.
- Migration 010's downgrade silently destroyed every pinned day and exclusion
  (`is_pinned` returned as DEFAULT 0, the exclusion table came back empty,
  exit 0, no warning). It now reconstructs both from `day_assertion`, and 009
  itemises what it cannot recover before dropping the table.
- Deleting a period left its assertions behind, locking those dates forever
  with no UI path to clear them. Wish deletion now clears them by `wish_id`.
- `DayAssertionService` and `LeaveWishService` committed multi-statement writes
  without a transaction; a crash mid-write diverged the tables or half-deleted
  a series. Both now run in a unit of work.
- A sibling year's shortfall was never surfaced: the toast only inspected the
  edited occurrence's outcome, so a fully unfunded later year rendered as an
  empty band with no warning.
- A flexible window whose bound had entirely elapsed was dropped from the
  proposal with no outcome at all. It now reports as `unplaced`.
- Unlocking a period deleted its days instead of returning them to the planner.
- The e2e global setup posted to a route deleted in this change, which would
  have failed the whole suite before its first test.

Gates: backend 938 tests / 91% coverage, frontend 1351 / 97.4 | 92.2 | 94.37 |
97.4. Migrations 009 and 010 audited against a hand-built realistic database:
the upgrade reconciles exactly and a constraint violation fails safe, leaving
the schema at 008.

Not complete. Step 4's toggle, month picker and lock/unlock action are verified
by browser walk and unit tests, but the partial-lock readout was not exercised.
`ideas.md` §7 adds a full plan for the vacation-forfeiture defect (the planner
detects expiring days and then does nothing about them) — not implemented here.
Remaining smaller items are listed in the session's restructure notes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T4wjgbVL4HAC5Rdaw75VbV

backend/tests/unit/test_services/test_allocation_input_loader.py

@@ -14,6 +14,7 @@ from uuid import uuid4
 import pytest
 
 from app.entities.child import Child
+from app.entities.day_assertion import DayAssertion
 from app.entities.day_override import DayOverride
 from app.entities.leave_wish import LeaveWish
 from app.entities.parental_leave import ParentalLeaveFetch, TierData
@@ -23,6 +24,7 @@ from app.entities.preschool_planning_days import PreschoolPlanningDays
 from app.entities.vacation_days import VacationDays
 from app.entities.workspace import Workspace
 from app.repositories_impl.sqlite.child_repository import SQLiteChildRepository
+from app.repositories_impl.sqlite.day_assertion_repository import SQLiteDayAssertionRepository
 from app.repositories_impl.sqlite.day_override_repository import SQLiteDayOverrideRepository
 from app.repositories_impl.sqlite.leave_wish_repository import SQLiteLeaveWishRepository
 from app.repositories_impl.sqlite.parental_leave_repository import SQLiteParentalLeaveRepository
@@ -46,6 +48,7 @@ def _make_loader(
     planned_leave_repo: SQLitePlannedLeaveRepository,
     leave_wish_repo: SQLiteLeaveWishRepository,
     preschool_planning_days_repo: SQLitePreschoolPlanningDaysRepository | None = None,
+    day_assertion_repo: SQLiteDayAssertionRepository | None = None,
 ) -> AllocationInputLoader:
     return AllocationInputLoader(
         workspace_repo=workspace_repo,
@@ -56,6 +59,7 @@ def _make_loader(
         planned_leave_repo=planned_leave_repo,
         leave_wish_repo=leave_wish_repo,
         preschool_planning_days_repo=preschool_planning_days_repo,
+        day_assertion_repo=day_assertion_repo,
     )
 
 
@@ -247,6 +251,7 @@ class TestAllocationInputLoader:
         vacation_repo: SQLiteVacationDaysRepository,
         planned_leave_repo: SQLitePlannedLeaveRepository,
         leave_wish_repo: SQLiteLeaveWishRepository,
+        day_assertion_repo: SQLiteDayAssertionRepository,
     ) -> None:
         """§fix (parent-reassignment moves dates, decision B) — `sync_plan`
 
@@ -307,7 +312,19 @@ class TestAllocationInputLoader:
                 parent_personal_data_uuid=parent.uuid,
                 date=date(2027, 10, 1),
                 day_type="vacation",
-                is_pinned=True,
+            )
+        )
+        # Restructure step 3b: "pinned" is a `DayAssertion` fact now.
+        await day_assertion_repo.create(
+            DayAssertion(
+                id=uuid4(),
+                workspace_id=ws.id,
+                child_id=child.id,
+                parent_personal_data_uuid=parent.uuid,
+                date=pinned.date,
+                day_type="vacation",
+                created_at=now,
+                updated_at=now,
             )
         )
         unpinned_wish_row = await planned_leave_repo.create(
@@ -319,7 +336,6 @@ class TestAllocationInputLoader:
                 date=date(2027, 10, 4),
                 day_type="vacation",
                 wish_id=wish.id,
-                is_pinned=False,
             )
         )
         ad_hoc = await planned_leave_repo.create(
@@ -331,7 +347,6 @@ class TestAllocationInputLoader:
                 date=date(2027, 10, 5),
                 day_type="vacation",
                 wish_id=None,
-                is_pinned=False,
             )
         )
 
@@ -343,6 +358,7 @@ class TestAllocationInputLoader:
             vacation_repo,
             planned_leave_repo,
             leave_wish_repo,
+            day_assertion_repo=day_assertion_repo,
         )
         alloc_input = await loader.load(ws.id, today=date(2027, 1, 1), only_pinned_existing=True)