Deduplicate logic across controllers, auth, and schema fixes

src/main/kotlin/com/android/trisolarisserver/controller/BookingFlow.kt

@@ -232,23 +232,12 @@ class BookingFlow(
     }
 
     private fun requireActor(propertyId: UUID, principal: MyPrincipal?): com.android.trisolarisserver.models.property.AppUser {
-        requirePrincipal(principal)
-        propertyAccess.requireMember(propertyId, principal!!.userId)
-        propertyAccess.requireAnyRole(propertyId, principal.userId, Role.ADMIN, Role.MANAGER, Role.STAFF)
-        return appUserRepo.findById(principal.userId).orElseThrow {
+        val resolved = requireRole(propertyAccess, propertyId, principal, Role.ADMIN, Role.MANAGER, Role.STAFF)
+        return appUserRepo.findById(resolved.userId).orElseThrow {
             ResponseStatusException(HttpStatus.UNAUTHORIZED, "User not found")
         }
     }
 
-    private fun parseOffset(value: String?): OffsetDateTime? {
-        if (value.isNullOrBlank()) return null
-        return try {
-            OffsetDateTime.parse(value.trim())
-        } catch (_: Exception) {
-            throw ResponseStatusException(HttpStatus.BAD_REQUEST, "Invalid timestamp")
-        }
-    }
-
     private fun parseTransportMode(value: String): TransportMode {
         return try {
             TransportMode.valueOf(value)
@@ -269,9 +258,4 @@ class BookingFlow(
         return allowed.contains(mode)
     }
 
-    private fun requirePrincipal(principal: MyPrincipal?) {
-        if (principal == null) {
-            throw ResponseStatusException(HttpStatus.UNAUTHORIZED, "Missing principal")
-        }
-    }
 }