Issue #3612171: Booking the same day twice leaves the visitor stuck: the calendar collides with their own hold and shows it as full

Fixes the re-entrancy of the calendar Book (full report in the issue).

• Book now reuses the session order and holds only the shortfall per target, so re-submitting a held pick resumes the order instead of colliding with the visitor own hold. The calendar never releases or moves a booking; whether a further booking is allowed is left to the resource constraint policies.
• The visitor own held places are published in a small client-read cookie so the calendar shows them as theirs (not full) and lets them resume. The globally cached availability feed and the calendar page are never personalized server-side, so the high-traffic path is unchanged.

Kernel tests cover the resume-without-colliding, the additive-without-releasing behavior, and the cookie projection with its mutation-gated write.