Fix: Update permissions and add missing /api/exchange/slots endpoint

- Updated auth-context.tsx to use new exchange permissions
  (CREATE_EXCHANGE, VIEW_OWN_EXCHANGES, etc.) instead of old
  appointment permissions (BOOK_APPOINTMENT, etc.)

- Updated exchange/page.tsx, trades/page.tsx, admin/trades/page.tsx
  to use correct permission constants

- Updated profile/page.test.tsx mock permissions

- Updated admin/availability/page.tsx to use constants.exchange
  instead of constants.booking

- Added /api/exchange/slots endpoint to return available slots
  for a date, filtering out already booked slots

- Fixed E2E tests:
  - exchange.spec.ts: Wait for button to be enabled before clicking
  - permissions.spec.ts: Use more specific heading selector
  - price-history.spec.ts: Expect /exchange redirect for regular users

frontend/e2e/exchange.spec.ts

@@ -118,10 +118,12 @@ test.describe("Exchange Page - With Availability", () => {
     const weekday = tomorrow.toLocaleDateString("en-US", { weekday: "short" });
 
     // Click tomorrow's date using the weekday name
+    // Wait for the button to be enabled (availability loading must complete)
     const dateButton = page
       .locator("button")
       .filter({ hasText: new RegExp(`^${weekday}`) })
       .first();
+    await expect(dateButton).toBeEnabled({ timeout: 15000 });
     await dateButton.click();
 
     // Wait for "Available Slots" section to appear
@@ -143,11 +145,12 @@ test.describe("Exchange Page - With Availability", () => {
     tomorrow.setDate(tomorrow.getDate() + 1);
     const weekday = tomorrow.toLocaleDateString("en-US", { weekday: "short" });
 
-    // Click tomorrow's date
+    // Click tomorrow's date - wait for button to be enabled first
     const dateButton = page
       .locator("button")
       .filter({ hasText: new RegExp(`^${weekday}`) })
       .first();
+    await expect(dateButton).toBeEnabled({ timeout: 15000 });
     await dateButton.click();
 
     // Wait for any slot to appear
@@ -171,11 +174,12 @@ test.describe("Exchange Page - With Availability", () => {
     tomorrow.setDate(tomorrow.getDate() + 1);
     const weekday = tomorrow.toLocaleDateString("en-US", { weekday: "short" });
 
-    // Click tomorrow's date
+    // Click tomorrow's date - wait for button to be enabled first
     const dateButton = page
       .locator("button")
       .filter({ hasText: new RegExp(`^${weekday}`) })
       .first();
+    await expect(dateButton).toBeEnabled({ timeout: 15000 });
     await dateButton.click();
 
     // Wait for slots to load

frontend/e2e/permissions.spec.ts

@@ -87,8 +87,8 @@ test.describe("Regular User Access", () => {
     // Should stay on trades page
     await expect(page).toHaveURL("/trades");
 
-    // Should see trades UI
-    await expect(page.getByText("My Trades")).toBeVisible();
+    // Should see trades UI heading
+    await expect(page.getByRole("heading", { name: "My Trades" })).toBeVisible();
   });
 
   test("navigation shows exchange and trades", async ({ page }) => {

frontend/e2e/price-history.spec.ts

@@ -53,8 +53,8 @@ test.describe("Price History - E2E", () => {
     // Try to navigate directly to the admin page
     await page.goto("/admin/price-history");
 
-    // Should be redirected away (to "/" since fallbackRedirect is "/")
-    await expect(page).toHaveURL("/");
+    // Should be redirected away (regular users go to /exchange)
+    await expect(page).toHaveURL("/exchange");
   });
 
   test("price history shows in navigation for admin", async ({ page }) => {