[codex] Add Reservations property operations snapshot

[SadPossum]

Depends on

• [codex] Synchronize backend documentation indexes #16 — backend documentation-index synchronization. This PR is intentionally based on that branch so the Reservations feature remains a single-domain diff.

What

• Adds an authoritative, property-local Reservations operations snapshot for Public API, Admin API, and Admin CLI.
• Returns exact reservation and guest counts for operational cohorts, disjoint attention queues, and a deterministic bounded upcoming list.
• Uses the projected property IANA time zone by default and supports an explicit reference date without pretending to provide historical/as-of state.
• Preserves ordinary reservation visibility and restriction rules, property-scoped authorization, no-store semantics, audit attribution, and table/JSON CLI parity.
• Adds explicit privacy governance for Public, Admin, and CLI output, including nested guest-facing fields.

Architecture and scale

• One module-owned CQRS query and one persistence reader; no synchronous cross-module call.
• One property projection read, one conditional aggregate, and one limit + 1 upcoming query in a provider-aware snapshot transaction.
• PostgreSQL uses REPEATABLE READ; SQL Server maps to SERIALIZABLE.
• upcomingLimit is explicit and bounded to 0..50; no fleet-wide fan-out is exposed.
• No schema migration or speculative index was added. Synthetic million-row explain evidence did not justify the write cost of another index.
• The contract is deliberately property-local; a future multi-property operations center should consume a dedicated roll-up/read model rather than loop over this endpoint.

Validation

• Full warning-as-error product build: green (known external NU1903 dependency finding isolated separately).
• Full non-Docker solution tests: 42/42 projects, 5,199/5,199 passed.
• Reservations tests: 282/282 passed.
• Focused snapshot/security/privacy matrix: 40/40 passed.
• Privacy catalog reflection/generation: 9/9 passed; catalog version 18.
• PostgreSQL snapshot/concurrency provider scenario: 1/1 passed.
• Real API/Admin/CLI Reservations saga: 1/1 passed, including auth, cross-property denial, malformed input, no-store, audit, JSON/table parity, and the existing stay lifecycle.
• Architecture tests: 103/103 passed.
• EF migration drift: 21/21 contexts clean.
• Repository security/release and diff checks: green.

Known repository dependencies

• The existing test-only SSH.NET advisory remains tracked by the separate dependency PR chain headed by backend draft [codex] Pin patched SSH.NET across backend test harness #14; this feature adds no dependency.
• The pinned GMA framework solution-index omission remains tracked by GMA draft #23; this feature does not modify GMA or a submodule pointer.
• No merge or deployment is performed by this PR.

[SadPossum]

Superseded by #13, which consolidates the property operations snapshot with the stay-amendment, retention-recovery, and Data Rights restriction-owner work into one tested Reservations candidate.