fix(booking): 允许管理员/老师通过同一接口取消任意预约

将 cancelBooking 改为接收 actor（{ id, isAdmin }），服务端按 JWT role
分流：普通成员仅能取消自己的预约，管理员跳过 owner check。
history 备注自动按 actor 选择「学员/管理员」前缀，审计可追溯。

客户端无感，仍调 PUT /booking/:id/cancel，前端零改动。

Co-Authored-By: Claude Code <noreply@anthropic.com>

packages/server/src/booking/booking.controller.ts

@@ -14,6 +14,7 @@ import { JwtAuthGuard } from '../auth/jwt-auth.guard'
 import { RolesGuard } from '../auth/roles.guard'
 import { Roles } from '../auth/roles.decorator'
 import { CurrentUser } from '../common/decorators/current-user.decorator'
+import { AuthenticatedUser } from '../auth/jwt.strategy'
 import { BookingService } from './booking.service'
 import { CreateBookingDto } from './dto/create-booking.dto'
 import { AdminArrangeBookingDto } from './dto/admin-arrange-booking.dto'
@@ -36,10 +37,13 @@ export class BookingController {
   @Put('booking/:id/cancel')
   @UseGuards(JwtAuthGuard)
   async cancelBooking(
-    @CurrentUser('sub') userId: string,
+    @CurrentUser() user: AuthenticatedUser,
     @Param('id') id: string,
   ) {
-    return this.bookingService.cancelBooking(userId, id)
+    return this.bookingService.cancelBooking(
+      { id: user.sub, isAdmin: user.role === UserRole.ADMIN },
+      id,
+    )
   }
 
   @Get('booking/my/activity')