5. Bike Reservation (5-min lock)

## Parent PRD

#1

## What to build

Reservation system that locks a bike for 5 minutes when a customer selects it. Customers should be able to reserve a bike, see their active reservation with countdown timer, and cancel before the timer expires. Reservations automatically expire after 5 minutes if the trip is not started.

Implements reservation state machine, overbooking prevention (one reservation per bike), expiry background job, and frontend countdown UI.

## Acceptance criteria

- [ ] `POST /bookings/reserve` reserves bike for 5 minutes (JWT required)
- [ ] Response includes: reservation_id, bike_id, station_id, expires_at timestamp
- [ ] `GET /bookings/active` returns current active reservation (JWT required)
- [ ] `POST /bookings/cancel` cancels reservation before expiry (JWT required)
- [ ] Cannot reserve a bike that is already reserved or in use
- [ ] Reservation expires exactly 5 minutes after creation
- [ ] Background job removes expired reservations every minute
- [ ] Cannot reserve bike with status != 'available'
- [ ] Customer can only have ONE active reservation at a time
- [ ] Database schema: `reservations` (id, user_id, bike_id, created_at, expires_at, status)
- [ ] Frontend: Reserve button on map marker, countdown timer, cancel button
- [ ] Frontend error: "Bike already reserved" if booking conflicts

## Blocked by

- Blocked by #2 (Authentication - needs user context)
- Blocked by #3 (Inventory - needs bikes)
- Blocked by #4 (Geolocation - user has selected bike)

## User stories addressed

- User story 3: Reserve bike for 5 minutes
- User story 4: Cancel reservation before arriving