Deduplicate logic across controllers, auth, and schema fixes

src/main/kotlin/com/android/trisolarisserver/controller/RoomStayFlow.kt

@@ -47,15 +47,12 @@ class RoomStayFlow(
     ): RoomChangeResponse {
         val actor = requireActor(propertyId, principal)
 
-        val stay = roomStayRepo.findById(roomStayId).orElseThrow {
-            ResponseStatusException(HttpStatus.NOT_FOUND, "Room stay not found")
-        }
-        if (stay.property.id != propertyId) {
-            throw ResponseStatusException(HttpStatus.NOT_FOUND, "Room stay not found for property")
-        }
-        if (stay.toAt != null) {
-            throw ResponseStatusException(HttpStatus.CONFLICT, "Room stay already closed")
-        }
+        val stay = requireOpenRoomStayForProperty(
+            roomStayRepo,
+            propertyId,
+            roomStayId,
+            "Room stay already closed"
+        )
         if (request.idempotencyKey.isBlank()) {
             throw ResponseStatusException(HttpStatus.BAD_REQUEST, "idempotencyKey required")
         }
@@ -114,22 +111,9 @@ class RoomStayFlow(
         )
     }
 
-    private fun parseOffset(value: String?): OffsetDateTime? {
-        if (value.isNullOrBlank()) return null
-        return try {
-            OffsetDateTime.parse(value.trim())
-        } catch (_: Exception) {
-            throw ResponseStatusException(HttpStatus.BAD_REQUEST, "Invalid timestamp")
-        }
-    }
-
     private fun requireActor(propertyId: UUID, principal: MyPrincipal?): com.android.trisolarisserver.models.property.AppUser {
-        if (principal == null) {
-            throw ResponseStatusException(HttpStatus.UNAUTHORIZED, "Missing principal")
-        }
-        propertyAccess.requireMember(propertyId, principal.userId)
-        propertyAccess.requireAnyRole(propertyId, principal.userId, Role.ADMIN, Role.MANAGER, Role.STAFF)
-        return appUserRepo.findById(principal.userId).orElseThrow {
+        val resolved = requireRole(propertyAccess, propertyId, principal, Role.ADMIN, Role.MANAGER, Role.STAFF)
+        return appUserRepo.findById(resolved.userId).orElseThrow {
             ResponseStatusException(HttpStatus.UNAUTHORIZED, "User not found")
         }
     }