Add Service.ExtendReservation (push out a hold's expiry)

A reservation's TTL is fixed at creation time. A slow checkout flow (a customer stuck on a payment form, a flaky payment gateway) has no way to ask for more time before the reaper reclaims its hold -- the only option today is to fail the checkout and make the customer start over.

Service.ExtendReservation does not exist yet; there is no way to push out an active reservation's expires_at.

1. go test ./tickets/tests/... -run TestTicket21 -v
2. Observe: both subtests panic with "TODO(ticket-21): Service.ExtendReservation not implemented".

This needs the same concurrency-correctness the rest of the reservation lifecycle already has: the reservation row must be locked for the duration of the check-and-update (so a concurrent Commit/Release/reaper sweep can't race it), and an already-expired-but-not-yet-reaped reservation must be treated as expired, not extendable -- the same "opportunistic expiry" rule resolve already applies to Commit and Release.

LockReservation (used by resolve, just above this method's stub) already does exactly the locking this needs. Look at how resolve structures its checks -- lock, check status, check whether now() is past expires_at -- and reuse that same shape for a simple instead of 's ledger-and-stock-effect logic (extending a hold doesn't touch or the ledger at all -- no quantity is moving between accounts).