Add public interface for submitting room booking requests

Introduces a new public-facing API endpoint and UI for submitting room booking requests without authentication, including rate limiting and input validation.

lib/db/src/schema/protocol.ts

@@ -88,6 +88,17 @@ export const protocolRoomBookingsTable = pgTable(
       .references(() => protocolRoomsTable.id, { onDelete: "cascade" }),
     title: varchar("title", { length: 500 }).notNull(),
     requesterName: varchar("requester_name", { length: 300 }),
+    // Guest-supplied contact phone. Only populated for public
+    // (self-service) booking requests; internal bookings leave it null.
+    requesterPhone: varchar("requester_phone", { length: 40 }),
+    // The requester's organization / entity (الجهة). Optional even for
+    // public requests; always null for internal bookings unless set.
+    requesterOrg: varchar("requester_org", { length: 300 }),
+    // Provenance marker. "internal" for bookings created by authenticated
+    // protocol staff through the app; "public" for guest requests coming in
+    // via the no-login booking-request link. Defaults to "internal" so all
+    // pre-existing rows are treated as internal.
+    source: varchar("source", { length: 20 }).notNull().default("internal"),
     // Full timestamps so bookings can span any part of a day. The overlap
     // rule compares [startsAt, endsAt) intervals per room.
     startsAt: timestamp("starts_at", { withTimezone: true }).notNull(),