Initial scaffold: tablet-checkin app

Staff-push guest check-in tablet. Fastify backend + React/Vite frontend,
three-tier auth (staff JWT, terminal API key, kiosk cookie), NewBook
integration via bookings_get/guests_update/bookings_update, pdfkit-based
regcard generation, marketing opt-in with Sendy/Mailchimp adapters.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/lib/push.js

@@ -0,0 +1,38 @@
+import { randomBytes } from 'crypto'
+import { pool, getSetting } from '../db.js'
+import { pushNavigate } from './device-stream.js'
+
+const SESSION_TTL_MINUTES = 30
+
+// Shared by routes/staff.js (terminal-key auth, the extension's real call)
+// and routes/devices.js's admin test-push (staff JWT auth) — both just need
+// "mint a session for this booking on this device", the auth tier differs,
+// the logic doesn't. See project_checkin's "Submission flow sequencing".
+export async function pushBookingToDevice(deviceId, bookingId) {
+  const { rows: existing } = await pool.query('SELECT * FROM devices WHERE device_id = $1', [deviceId])
+  if (!existing.length) return { ok: false, status: 404, error: 'Device not found' }
+
+  // Atomic claim — the UPDATE's own WHERE status='idle' is the source of
+  // truth, not the SELECT above (which is only used for a friendly device
+  // name in the 409 message), so two near-simultaneous pushes to the same
+  // device can't both "win".
+  const { rows: claimed } = await pool.query(
+    `UPDATE devices SET status = 'busy' WHERE device_id = $1 AND status = 'idle' RETURNING *`,
+    [deviceId]
+  )
+  if (!claimed.length) {
+    return { ok: false, status: 409, error: `${existing[0].name} is busy with another check-in` }
+  }
+
+  const hotelId = (await getSetting('newbook_hotel_id', '')) || process.env.NEWBOOK_LOCATION_ID || ''
+  const token = randomBytes(24).toString('hex')
+  const expiresAt = new Date(Date.now() + SESSION_TTL_MINUTES * 60 * 1000)
+
+  await pool.query(
+    `INSERT INTO checkin_sessions (token, device_id, booking_id, hotel_id, expires_at) VALUES ($1,$2,$3,$4,$5)`,
+    [token, deviceId, String(bookingId), hotelId, expiresAt]
+  )
+
+  const delivered = pushNavigate(deviceId, token)
+  return { ok: true, token, delivered }
+}