feat: add appointment CRUD backend (Phase 1D)

- AppointmentService with tenant-scoped List, GetByID, Create, Update, Delete
- List supports filtering by case_id, appointment_type, and date range (start_from/start_to)
- AppointmentHandler with JSON request/response handling and input validation
- Router wired up: GET/POST /api/appointments, PUT/DELETE /api/appointments/{id}

backend/internal/router/router.go

@@ -5,6 +5,8 @@ import (
 	"net/http"
 
 	"mgit.msbls.de/m/KanzlAI-mGMT/internal/auth"
+	"mgit.msbls.de/m/KanzlAI-mGMT/internal/handlers"
+	"mgit.msbls.de/m/KanzlAI-mGMT/internal/services"
 
 	"github.com/jmoiron/sqlx"
 )
@@ -15,13 +17,24 @@ func New(db *sqlx.DB, authMW *auth.Middleware) http.Handler {
 	// Public routes
 	mux.HandleFunc("GET /health", handleHealth(db))
 
+	// Services
+	appointmentSvc := services.NewAppointmentService(db)
+
+	// Handlers
+	apptH := handlers.NewAppointmentHandler(appointmentSvc)
+
 	// Authenticated API routes
 	api := http.NewServeMux()
 	api.HandleFunc("GET /api/cases", placeholder("cases"))
 	api.HandleFunc("GET /api/deadlines", placeholder("deadlines"))
-	api.HandleFunc("GET /api/appointments", placeholder("appointments"))
 	api.HandleFunc("GET /api/documents", placeholder("documents"))
 
+	// Appointments CRUD
+	api.HandleFunc("GET /api/appointments", apptH.List)
+	api.HandleFunc("POST /api/appointments", apptH.Create)
+	api.HandleFunc("PUT /api/appointments/{id}", apptH.Update)
+	api.HandleFunc("DELETE /api/appointments/{id}", apptH.Delete)
+
 	mux.Handle("/api/", authMW.RequireAuth(api))
 
 	return mux