Trang đặt lịch online cho tiệm, lưu dữ liệu thật

### Cấu trúc dữ liệu (Supabase)
- services(id, name_en, name_vi, minutes, price)
- staff(id, name, active)
- bookings(id, service_id, staff_id, start_at, end_at, customer_name, phone, email, language, status[pending/confirmed/cancelled], created_at)

### Chuỗi 6 prompt (Lovable)
1. "Create a mobile-first bilingual booking site for [Salon]. Pages: Home, Book, Admin. Use Supabase. Don't build yet; first propose the database tables and the booking flow, and wait for my OK."
2. "Create the tables exactly as agreed. Seed services and staff from this list: [...]."
3. "Build the Book flow: pick service → pick technician (or 'Any') → show available 15-minute slots for the next 14 days based on opening hours [...] and existing bookings → enter name, phone, email, language → confirm. Prevent double-booking on the server side."
4. "Build the Admin page protected by Supabase Auth (only my email can log in): today's schedule by technician, change status, cancel."
5. "Add row-level security: public users can only insert bookings and read available slots, never read other customers' data."
6. "Act as a QA tester. Try to double-book, book outside opening hours, book in the past, and access Admin without logging in. Report and fix every issue."
### Checklist trước khi đưa cho khách
Thử đặt trùng từ 2 điện thoại cùng lúc; kiểm tra email xác nhận; kiểm tra không xem được dữ liệu người khác; ghi chính sách hủy lịch.

---