Attach this account's guest bookings to it

Runs booking.claimGuestBookings. Call it once right after sign-in (and after sign-up), the same moment the web bookings page does. A guest checkout is complete and legitimate without an account (critical decision #4), so the booking row carries only guestEmail; this claims every unclaimed booking whose guest email matches the session's email — case-insensitively — and clears its booking token. Until it runs, GET /v1/bookings filters on userId and cannot see them, so a guest who booked in the app and then signed in on that same device loses their booking history (#1234). Idempotent: it returns { claimed: 0 } when there is nothing left to claim, so it is safe to call on every sign-in. Takes no input, so this route accepts no request body.