bugfix: appointment hours now use the client timezone on UTC servers.

Logical API errors throw stable codes so users see translated messages instead of a generic bad request.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/modules/staff/dto/upsert-working-hours.dto.ts

@@ -5,10 +5,14 @@ import {
   IsBoolean,
   IsInt,
   IsOptional,
+  IsString,
+  Matches,
   Max,
+  MaxLength,
   Min,
   ValidateNested,
 } from 'class-validator';
+import { ErrorCode } from '../../../common/errors';
 
 export class WorkingHoursBlockDto {
   @IsInt()
@@ -41,4 +45,9 @@ export class UpsertWorkingHoursDto {
   @ValidateNested({ each: true })
   @Type(() => WorkingHoursBlockDto)
   blocks: WorkingHoursBlockDto[];
+
+  @IsString()
+  @MaxLength(64)
+  @Matches(/^[A-Za-z0-9_+\-/]+$/, { message: ErrorCode.VALIDATION_TIMEZONE_INVALID })
+  timeZone: string;
 }