Reservations + tokenization #48
Description
POST /v1/reservations creates hold, confirms payment (stub), and issues ReservationToken with QR PNG (use your existing QR WebApi project).
GET /v1/reservations/{id}, POST /cancel, POST /transfer.
Store token_ref column (nullable) for future DLT transaction id.
DoD: Scanning QR calls GET /v1/reservations/{id} and shows status=active; cancel flips to canceled. (Reuses the QR module you already ship.)