Fix critical booking flow bugs blocking all bookings #3722 — ccantynz/hibiscus-to-airport

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/Hibiscus-to-airport/pull/25

Summary

Full audit of the booking system revealed several critical bugs that are blocking all customer bookings from completing:

Pydantic v2 rejecting bookings (422 error): The BookingCreate model had no extra="ignore" config. Since Pydantic v2 rejects unknown fields by default, every booking attempt failed because the frontend sends additionalPickups, paymentMethod, and payment_method — fields not defined in the model. This is the most likely cause of zero bookings.
Cash bookings hitting 404: Cash payment flow redirected to /booking/confirmation which doesn't exist in the router — users were silently bounced to the homepage by the catch-all route.
CORS blocking www. subdomain: Default CORS origins only included hibiscustoairport.co.nz but not www.hibiscustoairport.co.nz, so any visitor using www. would have API calls silently fail.
Stripe payment redirect using wrong URL: The checkout success/cancel redirects used REACT_APP_BACKEND_URL (a backend env var) with a fallback to localhost:3000 instead of the actual frontend domain.
Wrong phone number placeholder: Booking form showed fake +64 21 123 4567 instead of the real 021 743 321.

File	Fix
`backend/booking_routes.py`	Added `model_config = {"extra": "ignore"}`, `payment_method`, and `additionalPickups` fields to `BookingCreate`
`backend/booking_routes.py`	Fixed payment redirect URL fallback to `https://hibiscustoairport.co.nz`
`backend/server.py`	Added `https://www.hibiscustoairport.co.nz` to default CORS origins
`frontend/src/pages/BookingPage.jsx`	Fixed cash redirect to `/payment/success?method=cash`, fixed phone placeholder
`frontend/src/pages/PaymentSuccess.jsx`	Added cash-specific confirmation messaging
`EMAIL_SMS_TEMPLATE_MOCKUPS.md`	Fixed wrong phone number in template docs

Submit a test booking with Stripe payment — should complete without 422 error
Submit a test booking with cash payment — should redirect to success page with "pay the driver" message
Visit site via www.hibiscustoairport.co.nz and verify booking form works
Verify Stripe checkout redirects back to correct frontend URL on success/cancel
Check phone placeholder on booking form shows 021 743 321