Mint a single-use booking code

Input for POST /booking-codes/ -- the authenticated minting endpoint.

Collapses GraphQL's six create*BookingCode mutations into one resource: purpose x {calendar, appointment_type} is the same cross product those six mutations cover, no more and no less. purpose maps onto the permission(s) the minted token carries:

• book -> [EventManagementPermissions.CREATE]
• reschedule -> [EventManagementPermissions.RESCHEDULE]
• cancel -> [EventManagementPermissions.CANCEL]

calendar / appointment_type / event are plain integer ids, not PrimaryKeyRelatedField -- object existence and org/authorization checks happen in BookingCodeViewSet.create so a cross-organization target can be answered 404 there rather than a serializer-level 400, keeping "target exists but you can't see it" indistinguishable from "target does not exist".

No duration_seconds field: duration pinning lives on AppointmentType.duration, not on the minted token -- there is no per-code duration to set at mint time. A calendar-scoped code carries no duration constraint at all; an appointment-type-scoped code inherits whatever duration (if any) is already set on that appointment type.

One-time response for POST /booking-codes/.

code carries the plaintext booking code -- it is generated fresh by CalendarPermissionService.create_booking_token and never persisted or re-derivable, so this is the only response that will ever expose it. Every field here is read-only: this serializer only ever renders a response, it is never used to validate input.