feat: 14 new endpoints closing jupiter->Doormile API gaps, plus two tenant-scoping bug fixes

New endpoints:
- Admin: partner CRUD (GET/POST /admin/partners, GET/PUT/DELETE
  /admin/partners/:id), bulk express booking create
  (POST /admin/expressbooking/bulk), bulk cancel
  (POST /admin/bookings/bulk-cancel), reports (GET /admin/reports),
  password change (PUT /admin/profile/password), miler notify
  (POST /admin/milers/:id/notify)
- Miler: PIN reset (POST /miler/reset-pin), cancel assignment
  (POST /miler/bookings/:bookingid/cancel), skip delivery
  (POST /miler/consignments/:id/skip)
- Hub: batch assign (POST /hub/bookings/batch-assign) - greedy
  nearest-rider queue clearing, capped per rider

Bug fixes:
- BookingPickupComplete now sets Consignment.Tenantid from the
  booking's tenant instead of the completing miler's own tenant
  (fixes cross-tenant shipment mis-attribution)
- GetHubUnassignedBookings/GetHubBookingsRange now scoped via
  scopeBookingsToOwnTenant (fixes partner hub staff seeing other
  tenants' bookings)

Also: CRM booking routes renamed to expressbooking to end the naming
collision with the separate CRM clients feature; PickupBooking gains
nullable Tenantid; adds CLAUDE.md project memory.

Verified: go build ./... and go vet ./... both clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

models/booking.go

@@ -7,6 +7,14 @@ import (
 type PickupBooking struct {
 	Bookingid           int                  `json:"bookingid" gorm:"primaryKey;column:bookingid"`
 	Bookingno           string               `json:"bookingno" gorm:"column:bookingno;unique;not null"`
+	// Tenantid identifies which client company this booking is for. Nil for
+	// direct B2C bookings (Bookingsource "Customer_App") that aren't attributed
+	// to a tenant yet — see CreateCustomerBooking. Required for CRM bookings
+	// (Bookingsource "CRM_Console"), since those are always made on behalf of
+	// a specific tenant. Propagated onto the resulting Consignment at pickup
+	// time in BookingPickupComplete, instead of inferring it from whichever
+	// miler happens to complete the pickup.
+	Tenantid            *int                 `json:"tenantid" gorm:"column:tenantid;index"`
 	Appcustomerid       int                  `json:"appcustomerid" gorm:"column:appcustomerid"`
 	Pickuplocationid    *int                 `json:"pickuplocationid" gorm:"column:pickuplocationid"`
 	Pickupaddress       string               `json:"pickupaddress" gorm:"column:pickupaddress;not null"`