fix(feeds): keep a staged booking out of the public feed and the shared trip

The ICS feed is public with a token that never expires and prints the
confirmation number into the DESCRIPTION, and the shared-trip payload does a
SELECT * over reservations with share_bookings on by default. Neither filters
anything, so whatever lands on a trip is published the moment it is written.
That is fine while a person types every booking in, and it stops being fine as
soon as something writes on their behalf.

reservations.ingest_state is that gate. It defaults to live, SQLite backfills
every existing row on the ALTER, and no current writer names the column, so
every booking visible today stays visible. Nothing writes staged yet.

The predicate takes its table alias because share.service.ts queried
reservations without one. A stay is withheld only when bookings point at it and
all of them are staged: a hand-added hotel has no booking at all and has to keep
showing up.

server/src/nest/calendar/calendar.service.ts

@@ -1,6 +1,7 @@
 import { Injectable } from '@nestjs/common';
 import { DatabaseService } from '../database/database.service';
 import { ReservationsService } from '../reservations/reservations.service';
+import { publicReservationSql, publicStaySql } from '../reservations/reservation-visibility';
 import { addDays } from '../days/days.service';
 import { resolveTimeZone } from '../common/timezoneService';
 import { NotFoundError } from '../common/domain-errors';
@@ -163,7 +164,7 @@ export class CalendarService {
          LEFT JOIN days ed ON a.end_day_id = ed.id
          LEFT JOIN days rd ON r.day_id = rd.id
          LEFT JOIN days red ON r.end_day_id = red.id
-         WHERE r.trip_id = ?`,
+         WHERE r.trip_id = ? AND ${publicReservationSql('r')}`,
       )
       .all(tripId) as any[];
 
@@ -569,13 +570,13 @@ export class CalendarService {
              sd.date AS start_date, ed.date AS end_date,
              p.name AS place_name, p.address AS place_address, p.lat AS place_lat, p.lng AS place_lng,
              (SELECT r.title FROM reservations r
-               WHERE r.accommodation_id = a.id
+               WHERE r.accommodation_id = a.id AND ${publicReservationSql('r')}
                ORDER BY r.id ASC LIMIT 1) AS reservation_title
       FROM day_accommodations a
       LEFT JOIN days sd ON a.start_day_id = sd.id
       LEFT JOIN days ed ON a.end_day_id = ed.id
       LEFT JOIN places p ON a.place_id = p.id
-      WHERE a.trip_id = ?
+      WHERE a.trip_id = ? AND ${publicStaySql('a')}
       ORDER BY a.id ASC
     `).all(tripId) as any[];