WIP: Sicherheitsnetz vor Phase-1-R\u00fcckbau

Enth\u00e4lt gemischt: Laravel-10-Upgrade + Phase 1 (Contacts-Modul, Duplicats-Commands,
Soft-Delete+Merge-Fields) + Phase 2 Code-Umstellungen (inquiry_id, $table='contacts'/'inquiries')
+ Offers-Modul (Migrationen, Models, offer_id in Booking, offer-Disk in filesystems.php).

Phase 2 + Offers werden im folgenden Commit nach dev/backups/phase2-offers-2026-04-17/
verschoben, damit der Workspace auf Phase-1-only (= Test-System-Stand) reduziert ist
und direkt auf Live deploybar wird.

Tarball-Backup zus\u00e4tzlich unter: ../backups-safety/workspace-pre-phase1-rollback-2026-04-17.tar.gz

Made-with: Cursor

tests/Feature/Api/BookingImportTest.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Tests\Feature\Api;
+
+use Tests\TestCase;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+class BookingImportTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private string $validKey = 'f6077389c9ce710e554763a5de02c8ec';
+
+    public function testImportRejectsRequestWithoutKey(): void
+    {
+        $response = $this->postJson('/api/booking/import', [
+            'travel_booking_id' => 1,
+        ]);
+
+        $response->assertStatus(401);
+        $response->assertJson(['error' => 'key']);
+    }
+
+    public function testImportRejectsRequestWithWrongKey(): void
+    {
+        $response = $this->postJson('/api/booking/import', [
+            'key'               => 'wrong-key',
+            'travel_booking_id' => 1,
+        ]);
+
+        $response->assertStatus(401);
+        $response->assertJson(['error' => 'key']);
+    }
+
+    public function testImportReturnsErrorWhenBookingNotFound(): void
+    {
+        $response = $this->postJson('/api/booking/import', [
+            'key'               => $this->validKey,
+            'travel_booking_id' => 999999,
+        ]);
+
+        $response->assertStatus(200);
+        $response->assertJson(['error' => 'no-booking-found']);
+    }
+}