N>1 reschedule: preference-scored auto-allocation

[teetangh]

What "Any time works" does today

Releasing sessions without naming a time works on every reschedule surface at
every session count. That half is shipped (#1064). What is missing is the
consultee's ability to say how they would like the replacement placed — the
preference that a consultant's auto-allocate would then honour.

Why this is a build, not a wiring job

AutoAllocationPreferences exists in lib/scheduling/allocationAlgorithms.ts
and looks ready to connect. It is not:

1. Its only consumer is AllocationAlgorithms.autoAllocate, which runs in the
   browser.
2. That path is dead. useSlotAllocation.autoAllocate has called the server
   since Request Calendar performance: slow PENDING list endpoints + move client-side allocation engine server-side #997 Phase 1 — its own comment records that the old path "fetched the
   consultant's entire scheduling period of availability into the browser and
   ran AllocationAlgorithms here."
3. SlotAllocationService, the live allocator, has no preference plumbing at
   all.

The trap in the existing implementation

filterSlotsByPreferences filters:

if (preferences.preferMorning && (hour < 9 || hour >= 12)) return false;

A consultee who prefers mornings, booking a consultant with no morning
availability, gets "no slots available" with the whole afternoon free. That is
the same shape as the A1 defect this branch's predecessor fixed, where
findAvailableSlots tested one candidate start per availability row.

A preference must score candidates, never remove them. The worst outcome of
an unsatisfiable preference is a less-liked time, never a failed allocation.

Scope when picked up

• A preference field on RescheduleRequest (migration).
• A control on SlotPicker, shown on the release-without-a-time path.
• Score-based ordering inside findAvailableSlots, replacing first-fit.

Note the blast radius on the third: every event type's auto-allocate goes
through findAvailableSlots, so changing its selection order changes
allocations well beyond reschedules. That is why it was kept out of #1064
rather than added to nine commits still pending browser verification.

Deleting the dead filterSlotsByPreferences path belongs with this work — it
is a working-looking implementation of the wrong algorithm, which is worse
than an absent one.