feat: rebrand AgendaPro -> AgendaMax + calendar fixes + current-week demo seed

- Rebrand all user-facing text to AgendaMax
- Fix sidebar scrolling: card container no longer overflows html (flex h-full min-h-0)
- Fix calendar toolbar hover: active buttons keep readable contrast
- Sticky calendar toolbar (month/week/day always visible on scroll)
- Seed guarantees 2-4 appointments per day for current week (Mon-Sat)

server/routes/appointments.ts

@@ -26,7 +26,11 @@ function joinAppointment(a: any) {
     .prepare(`SELECT id, name, color, role FROM employees WHERE id = ?`)
     .get(a.employee_id);
   a.client = db
-    .prepare(`SELECT id, name, phone, email, tags FROM clients WHERE id = ?`)
+    .prepare(
+      `SELECT c.id, c.name, c.phone, c.email, c.notes, c.tags,
+              (SELECT COUNT(*) FROM appointments a2 WHERE a2.client_id = c.id AND a2.status = 'no_show') AS no_show_count
+       FROM clients c WHERE c.id = ?`
+    )
     .get(a.client_id);
   return a;
 }
@@ -177,6 +181,9 @@ appointmentsRouter.patch("/:id", (req: AuthedRequest, res) => {
     .prepare(`SELECT * FROM appointments WHERE id = ? AND business_id = ?`)
     .get(id, req.user!.business_id) as any;
   if (!existing) return err(res, 404, "Cita no encontrada");
+  if (req.user!.role === "employee" && existing.employee_id !== req.user!.employee_id) {
+    return err(res, 403, "No puedes modificar una cita que no es tuya");
+  }
 
   const {
     service_id,
@@ -255,6 +262,9 @@ appointmentsRouter.post("/:id/complete", (req: AuthedRequest, res) => {
     .prepare(`SELECT * FROM appointments WHERE id = ? AND business_id = ?`)
     .get(id, req.user!.business_id) as any;
   if (!appt) return err(res, 404, "Cita no encontrada");
+  if (req.user!.role === "employee" && appt.employee_id !== req.user!.employee_id) {
+    return err(res, 403, "No puedes modificar una cita que no es tuya");
+  }
   const { tip = 0, payment_method = "card" } = req.body ?? {};
   db.prepare(`UPDATE appointments SET status = 'completed', updated_at = datetime('now') WHERE id = ?`).run(id);
   const hasTicket = db.prepare(`SELECT id FROM tickets WHERE appointment_id = ?`).get(id);
@@ -279,9 +289,12 @@ appointmentsRouter.post("/:id/complete", (req: AuthedRequest, res) => {
 appointmentsRouter.delete("/:id", (req: AuthedRequest, res) => {
   const id = Number(req.params.id);
   const existing = db
-    .prepare(`SELECT id FROM appointments WHERE id = ? AND business_id = ?`)
-    .get(id, req.user!.business_id);
+    .prepare(`SELECT id, employee_id FROM appointments WHERE id = ? AND business_id = ?`)
+    .get(id, req.user!.business_id) as any;
   if (!existing) return err(res, 404, "Cita no encontrada");
+  if (req.user!.role === "employee" && existing.employee_id !== req.user!.employee_id) {
+    return err(res, 403, "No puedes modificar una cita que no es tuya");
+  }
   db.prepare(`DELETE FROM appointments WHERE id = ?`).run(id);
   res.json({ ok: true });
 });