Fix NewBook write mechanism, bundle push extension, remove vestigial hotel_id

- setBookingCustomFields: use bookings_update's own custom_fields array
  (confirmed from the real legacy plugin code) instead of
  instance_custom_fields_set, which was only ever proven for a different,
  unrelated plugin
- online_checkin_complete is now a configurable per-hotel custom field
  (online_checkin_complete_custom_field_id setting), not a bogus top-level
  bookings_update field NewBook would silently ignore
- Fix field-name mismatches vs a real live NewBook booking response:
  booking_arrival/departure/length, guest address (street/city/state/
  postcode/country, not a single field), phone/mobile (in contact_details,
  not top-level), and pickPrimaryGuest now checks primary_client (was
  checking fields that don't exist in the real API)
- Bundle the standalone push extension into backend/extension-src/, add
  GET /api/extension/download (zips on request via archiver) and a
  download button on the Settings page
- Remove newbook_hotel_id — vestigial from the legacy system's multi-hotel
  routing model, never actually reached NewBook's API, this stack is
  single-hotel-per-deployment so there's nothing to route between

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/extension-src/popup/popup.css

@@ -0,0 +1,47 @@
+body {
+  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+  width: 300px;
+  margin: 0;
+  padding: 12px 14px;
+  color: #1e293b;
+  background: #f4f5f7;
+}
+.header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  margin-bottom: 10px;
+}
+.title { font-weight: 700; font-size: 14px; color: #1a1a2e; }
+.nb-status { font-size: 11px; padding: 2px 8px; border-radius: 999px; }
+.nb-status.ok { background: #dcfce7; color: #166534; }
+.nb-status.no { background: #fee2e2; color: #991b1b; }
+.muted { color: #64748b; font-size: 13px; }
+.booking { font-size: 13px; margin-bottom: 10px; }
+.booking strong { color: #1a1a2e; }
+select {
+  width: 100%;
+  box-sizing: border-box;
+  padding: 8px;
+  border-radius: 8px;
+  border: 1px solid #e4e8ee;
+  margin-bottom: 10px;
+  font-size: 13px;
+}
+button.primary {
+  width: 100%;
+  padding: 10px;
+  border: none;
+  border-radius: 8px;
+  background: #c9a84c;
+  color: #1a1a2e;
+  font-weight: 700;
+  font-size: 13px;
+  cursor: pointer;
+}
+button.primary:disabled { opacity: 0.5; cursor: default; }
+.msg { margin-top: 10px; font-size: 12px; }
+.msg.error { color: #dc2626; }
+.msg.ok { color: #16a34a; }
+.msg.warn { color: #b45309; }
+a.settings-link { display: block; margin-top: 12px; font-size: 12px; color: #7b4f00; }

backend/extension-src/popup/popup.html

@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8" />
+  <title>Send to Check-In Tablet</title>
+  <link rel="stylesheet" href="popup.css" />
+</head>
+<body>
+  <div class="header">
+    <span class="title">Check-In Tablet</span>
+    <span id="nbStatus" class="nb-status"></span>
+  </div>
+
+  <div id="content">
+    <p class="muted">Loading…</p>
+  </div>
+
+  <script type="module" src="popup.js"></script>
+</body>
+</html>

backend/extension-src/popup/popup.js

@@ -0,0 +1,113 @@
+import { isNewBookLoggedIn } from '../newbook-auth.js';
+
+// Same regex as background.js — re-derived independently here from the live
+// tab URL each time the popup opens (rather than trusting chrome.storage
+// left over from the background script) so a stale badge state can never
+// show a booking that isn't actually the one currently open. Confirmed
+// 2026-09-01 by the user directly (real NewBook page URLs).
+const BOOKING_URL_RE = /\/bookings_(?:view|edit|checkin)\/(\d+)/i;
+
+const contentEl = document.getElementById('content');
+const nbStatusEl = document.getElementById('nbStatus');
+
+async function main() {
+  const [tab] = await chrome.tabs.query({ active: true, currentWindow: true });
+  const bookingMatch = tab?.url?.match(BOOKING_URL_RE);
+  const bookingId = bookingMatch ? bookingMatch[1] : null;
+
+  isNewBookLoggedIn().then(ok => {
+    nbStatusEl.textContent = ok ? 'NewBook: signed in' : 'NewBook: not detected';
+    nbStatusEl.className = `nb-status ${ok ? 'ok' : 'no'}`;
+  });
+
+  const { baseUrl, apiKey } = await chrome.storage.local.get(['baseUrl', 'apiKey']);
+  if (!baseUrl || !apiKey) {
+    contentEl.innerHTML = `
+      <p class="muted">Not set up yet — add the tablet-checkin URL and a terminal API key first.</p>
+      <a class="settings-link" href="#" id="openSettings">Open Settings</a>
+    `;
+    document.getElementById('openSettings').addEventListener('click', e => {
+      e.preventDefault();
+      chrome.runtime.openOptionsPage();
+    });
+    return;
+  }
+
+  if (!bookingId) {
+    contentEl.innerHTML = `<p class="muted">Open a booking in NewBook to send it to a check-in tablet.</p>`;
+    return;
+  }
+
+  contentEl.innerHTML = `
+    <p class="booking">Booking <strong>#${bookingId}</strong></p>
+    <select id="device"><option>Loading tablets…</option></select>
+    <button class="primary" id="send" disabled>Send to Check-In Tablet</button>
+    <div id="msg"></div>
+  `;
+
+  const deviceSelect = document.getElementById('device');
+  const sendBtn = document.getElementById('send');
+  const msgEl = document.getElementById('msg');
+
+  let devices = [];
+  try {
+    const res = await fetch(`${baseUrl}/api/staff/devices`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+    });
+    if (!res.ok) throw new Error((await res.json().catch(() => ({}))).error || `HTTP ${res.status}`);
+    devices = await res.json();
+  } catch (err) {
+    deviceSelect.innerHTML = '<option>Could not load tablets</option>';
+    setMsg(msgEl, `Could not reach tablet-checkin: ${err.message}`, 'error');
+    return;
+  }
+
+  if (!devices.length) {
+    deviceSelect.innerHTML = '<option>No tablets registered yet</option>';
+    return;
+  }
+
+  deviceSelect.innerHTML = devices.map(d =>
+    `<option value="${d.device_id}" ${d.status === 'busy' ? 'disabled' : ''}>
+      ${escapeHtml(d.name)}${d.status === 'busy' ? ' (busy)' : ''}
+    </option>`
+  ).join('');
+  sendBtn.disabled = false;
+
+  sendBtn.addEventListener('click', async () => {
+    sendBtn.disabled = true;
+    setMsg(msgEl, 'Sending…', 'warn');
+    try {
+      const res = await fetch(`${baseUrl}/api/staff/push`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
+        body: JSON.stringify({ booking_id: bookingId, device_id: deviceSelect.value }),
+      });
+      const body = await res.json().catch(() => ({}));
+      if (res.status === 409) {
+        setMsg(msgEl, body.error || 'That tablet is busy with another guest right now.', 'warn');
+      } else if (!res.ok) {
+        throw new Error(body.error || `HTTP ${res.status}`);
+      } else {
+        setMsg(msgEl, 'Sent — the tablet should navigate now.', 'ok');
+      }
+    } catch (err) {
+      setMsg(msgEl, `Failed: ${err.message}`, 'error');
+    } finally {
+      sendBtn.disabled = false;
+    }
+  });
+}
+
+function setMsg(el, text, kind) {
+  el.textContent = text;
+  el.className = `msg ${kind}`;
+}
+
+function escapeHtml(s) {
+  const div = document.createElement('div');
+  div.textContent = s;
+  return div.innerHTML;
+}
+
+main();