Undoes a booking this key created — the one thing the External API has
never been able to do. A separate scope from bookings:write on
purpose: a key issued to sell rooms should not also be able to
un-sell the hotel's. A leaked write-only key can cost the merchant
inventory; one that could also cancel could empty the property's
forward book.

Idempotent by state, not by Idempotency-Key. Cancelling an
already-cancelled booking answers 200 with the same body rather
than an error — a retry after a lost response is the normal case, not
a mistake to refuse.

Only a stay that has not started — pending or confirmed — can be
cancelled here. A merchant can reverse a stay that is already
checked_in or checked_out by hand in the PMS, because a human is
there to weigh the folio consequences. This endpoint deliberately
cannot: cancelling a checked_in booking would mark an occupied room
available and manufacture an overbooking, and reversing a completed
stay is a merchant-only correction. Neither is something a leaked key
should be able to trigger.

A booking outside this property answers 404, identically to one
that does not exist.

Scope: bookings:cancel · Property-bound

See Holds.