Reliability & correctness fixes: parser outage, update-path conflicts, timezone, CORS

[freddy-tama]

So, the app works well on the happy path, but several failure modes are handled by
disabling a safeguard rather than fixing it. Grouping them here:

1. NL parse has a single point of failure — when OpenRouter errors (e.g. 402),
   the headline command-bar feature is fully down. Proposed: fall back to a
   deterministic parser so it always responds, tagging the source.
2. Conflict detection runs only on create; drag/resize can silently
   double-book. Proposed: check on update too, excluding the event itself.
3. No timezone handling — "besok jam 10" is computed in server time. Proposed:
   pass the client offset and store UTC.
4. Trailing slash in the API URL causes a 307 that drops CORS and breaks login.
   Proposed: normalize the base URL client-side and avoid the redirect.
5. DB-down states are swallowed (health reports ok while writes fail).
   Proposed: structured 503s + honest health with latency.

[bagusardin25]

good