Build a booking app with real availability rules and no double-bookings

Build Northline Tutoring, a booking app for one-on-one SAT tutoring sessions where a client can only ever book a real, open slot — no double-bookings, no bookings inside a provider's buffer time, and no timezone confusion between the provider and the client.

PRODUCT
Clients pick a provider and a time slot from real availability and book a 50-minute session. Providers set their own weekly availability and can block off specific dates.

DATA MODEL
- Provider: id, user_id, name, timezone (IANA string, e.g. America/Chicago), bio.
- AvailabilityRule: id, provider_id (references Provider), day_of_week (0-6), start_time, end_time — recurring weekly windows in the provider's own timezone.
- BlockedDate: id, provider_id (references Provider), date, reason — one-off exceptions like a holiday or vacation day.
- Booking: id, provider_id (references Provider), client_id, starts_at (stored as a UTC timestamp, never a naive local time), ends_at, status (confirmed, canceled, or completed), created_at.

AVAILABILITY AND CONFLICT RULES
Store every Booking's starts_at and ends_at in UTC, and convert to and from the provider's or client's local timezone only at the point of display — never store a local time string and hope the offset stays correct. A slot is only bookable if it falls entirely inside an AvailabilityRule window for that day of week, is not covered by a BlockedDate, and does not overlap any existing confirmed Booking for that provider, including a 10-minute buffer before and after every existing booking. Enforce the no-overlap rule with a database constraint or a single atomic check-and-insert transaction, not a client-side calendar check followed by a separate insert — two clients hitting "book" within the same second on the same slot must not both succeed; the second one must see a clear "this slot was just taken" message instead of a silently double-booked provider.

CANCELLATION AND CHANGES
A client can cancel their own booking up until 24 hours before starts_at; after that window, canceling requires the provider's own action, not the client's self-serve button. Canceling a Booking must immediately free that slot for someone else to book — it is not enough to just mark status canceled if the availability query doesn't also check status when computing open slots.

SCREENS
1. Public booking page: provider picks a date, sees only genuinely open slots (already filtered by all the rules above) rendered in the client's own browser timezone, picks one, confirms.
2. Booking confirmation screen and email showing the time in the client's timezone explicitly labeled with the timezone name, not just a bare time, plus a scannable QR code the client can show at check-in that the provider scans to mark the booking completed instantly.
3. Provider dashboard: weekly availability editor, blocked-date picker, and an upcoming-bookings list.
4. Cancel/reschedule flow respecting the cancellation window above.

CONSTRAINTS
Use Lovable's Supabase integration for auth and the database; enforce the no-overlap rule with a real database-level constraint or transaction, not JavaScript that runs after the fact. Most tutors are in US Central time but clients book from anywhere, so the timezone label on every confirmation is not optional.