fix: unified change history, stateless MCP specs and stale linked bookings

[stakach]

Updates staff-api for placeos-models 9.122 (unified change history, PlaceOS/models#337 #338 #339) and fixes the specs failing on master.

Changes

• Change history
  • Calendar event changes are recorded with History.record_change. GET /events/history reads the new columns and returns entries of both the events and their metadata, newest first. Existing rows are migrated by models (fix(bookings): add bookings. to checked_out in sql #339).
  • Breaking: /events/history entries now have resource_type instead of type, and the unified fields (diff, user_id, context, ...).
  • Like rest-api, an around filter attributes changes, such as bookings, to the request: user, API key, X-App-* headers, user agent, IP and request id.
• Stale linked_bookings (failing on master): ExecutionContext.offload_responses is a compile time macro, so the OFFLOAD_WORKERS check never disabled it.
  • Transaction-wrapped routes serialised their response in another fiber, on a connection that couldn't see the uncommitted writes. Updating a parent booking returned its children's old times.
  • Responses are no longer offloaded. The bookings index still runs in its own context.
• MCP specs (failing on master): action-controller 9.2 made MCP stateless, so initialize no longer returns Mcp-Session-Id.
• SQL injection spec: spaces in the query are encoded, as Crystal 1.22 rejects them.

Review

• See the test results below. bookings_spec.cr:1161 (cancelled while checked in) failed once in a full local run and passed 4/4 alone; it is timing based (Timecop with sleeps).

🤖 Generated with Claude Code