Replace hand-marked slots inside a window (live for a proven address, otherwise confirmed by email)

The manual fallback for people who do not publish an iCloud calendar, prefer not to connect a calendar, use another unsupported calendar, or have no calendar; the heat-map labels it source "manual". Goes LIVE FOR EVERYONE (200) when the caller is signed in and the email is one of their own addresses (account email, a connected Google / Microsoft calendar, a team address they joined under), or when k is the owner proof returned by Confirm. With a host-issued ask-link k (POST /api/ask-links) it goes live ONLY FOR THAT HOST (200 with scope: "host" and hostName): their picker and meeting heat-maps see it, nobody else does, until the person shares it with everyone (POST /api/manual-availability/share). Anyone else gets 202 { ok, pending: true, email }: nothing is published, and that address gets a "Confirm your free times" email whose link (GET /api/manual-availability/confirm) opens /free with a one-click Confirm (POST /api/manual-availability/confirm) that publishes the save. Pending saves expire after 7 days (≤ 5 per address); a save that is live for everyone drops the address's older pending ones (a host-scoped save keeps them). Confirmation emails per 24 h: 3 per sender per address, 10 per address, 20 per signed-in sender (session / PAT) and 10 per anonymous IP per hour (claimed atomically before anything is stored; a refused mail costs nothing). Anonymous callers need a Turnstile token (also with k), and may not paint an address that has a connected account (409). Rate-limited per email (30 saves/h); a host-scoped save counts against that host's own budget for the address, so nobody's ask-link saves use up the owner's.