Integrate LiveKit SFU and harden booking workflow

app/(payload)/api/booking/request/route.ts

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { getPayload } from "payload";
 import config from "@payload-config";
 import { getAvailableSlots } from "@/lib/booking/slots";
+import { berlinDayBounds } from "@/lib/calendar/timezone";
 
 export const dynamic = "force-dynamic";
 
@@ -59,16 +60,13 @@ export async function POST(request: Request) {
     // Re-validate the slot is actually free right now (defense against a
     // stale slot list) — the hard, race-safe check still runs again when
     // Anna confirms (see collections/BookingRequests.ts).
-    const dayStart = new Date(start);
-    dayStart.setHours(0, 0, 0, 0);
-    const dayEnd = new Date(start);
-    dayEnd.setHours(23, 59, 59, 999);
+    const dayBounds = berlinDayBounds(start);
     const slotsByDay = await getAvailableSlots(payload, {
       durationMinutes: offer.durationMinutes,
-      from: dayStart,
-      to: dayEnd,
+      from: dayBounds.start,
+      to: dayBounds.end,
     });
-    const key = dayStart.toISOString().slice(0, 10);
+    const key = dayBounds.key;
     const isStillFree = (slotsByDay.get(key) ?? []).some((s) => s.start.getTime() === start.getTime());
     if (!isStillFree) {
       return NextResponse.json({ error: "Dieser Termin ist leider nicht mehr verfügbar." }, { status: 409 });

app/(payload)/api/booking/slots/route.ts

@@ -29,11 +29,21 @@ export async function GET(request: Request) {
       return NextResponse.json({ error: "Dieses Angebot ist nicht buchbar." }, { status: 404 });
     }
 
-    const from = fromParam ? new Date(fromParam) : new Date();
+    const from = fromParam ? new Date(`${fromParam}T00:00:00`) : new Date();
+    if (Number.isNaN(from.getTime())) {
+      return NextResponse.json({ error: "Ungültiges Startdatum." }, { status: 400 });
+    }
     from.setHours(0, 0, 0, 0);
-    const to = toParam ? new Date(toParam) : new Date(from.getTime() + 21 * 24 * 60 * 60 * 1000);
+    const to = toParam ? new Date(`${toParam}T00:00:00`) : new Date(from.getTime() + 21 * 24 * 60 * 60 * 1000);
+    if (Number.isNaN(to.getTime())) {
+      return NextResponse.json({ error: "Ungültiges Enddatum." }, { status: 400 });
+    }
     to.setHours(23, 59, 59, 999);
 
+    if (to < from) {
+      return NextResponse.json({ error: "Das Enddatum muss nach dem Startdatum liegen." }, { status: 400 });
+    }
+
     // Cap the range so this can't be abused to run an expensive scan.
     const maxRangeMs = 62 * 24 * 60 * 60 * 1000;
     if (to.getTime() - from.getTime() > maxRangeMs) {