feat(api): add staff order booking contract and shift timeline alias

docs/BACKEND/API_GUIDES/V2/mobile-coding-agent-spec.md

@@ -6,7 +6,7 @@ Use this as the primary implementation brief.
 
 Base URL:
 
-- `https://krow-api-v2-933560802882.us-central1.run.app`
+- `https://krow-api-v2-e3g6witsvq-uc.a.run.app`
 
 Supporting docs:
 
@@ -23,6 +23,7 @@ Supporting docs:
 - Send `Idempotency-Key` on every write route.
 - Treat `order`, `shift`, `shiftRole`, and `assignment` as different objects.
 - For staff shift applications, `roleId` must come from the response of `GET /staff/shifts/open`.
+- For staff order booking, `roleId` must come from the response of `GET /staff/orders/available`.
 - Treat API timestamp fields as UTC and convert them to local time in the app.
 
 ## 2) What is implemented now
@@ -90,8 +91,10 @@ Do not assume staff auth is a fully backend-managed OTP flow.
 Rules:
 
 - `GET /staff/shifts/open` returns opportunities, not assignments
+- `GET /staff/orders/available` returns grouped order opportunities for booking
 - `GET /staff/shifts/assigned` returns active assigned shifts
-- `GET /client/orders/view` is the timeline/read model for client
+- `GET /client/shifts/scheduled` is the canonical timeline/read model for client
+- `GET /client/orders/view` is now a deprecated compatibility alias
 - `POST /client/orders/:orderId/edit` and `POST /client/orders/:orderId/cancel` apply to future shifts only
 
 ## 5) Client app screen mapping
@@ -165,7 +168,8 @@ Swap management flow:
 
 ### Orders
 
-- `GET /client/orders/view`
+- `GET /client/shifts/scheduled`
+- `GET /client/orders/view` deprecated alias
 - `GET /client/orders/:orderId/reorder-preview`
 - `POST /client/orders/one-time`
 - `POST /client/orders/recurring`
@@ -230,12 +234,17 @@ Important:
 
 ### Find shifts
 
+- `GET /staff/orders/available`
+- `POST /staff/orders/:orderId/book`
 - `GET /staff/shifts/open`
 - `POST /staff/shifts/:shiftId/apply`
 
 Rule:
 
-- use `roleId` from the open-shifts response
+- use `roleId` from the order-available response when booking an order
+- that `roleId` is the role catalog id for the grouped order booking flow
+- use `roleId` from the open-shifts response only for shift-level apply
+- that `roleId` is the concrete `shift_roles.id`
 
 ### My shifts