FL-1110 feat: gate externalReservationId to FL-attributed reservations
externalReservationId dereferences to guest PII via our POS API key, so it is lawful to publish only for FL-attributed (consented) rows. Make it omitempty / not required; ETL sets it only when customerId != nil. Non-FL reservations carry no id (anonymous aggregate plane, D-51). Tests: empty id validates OK; required-table no longer lists it.