fix: repair the booking flow end to end

Verified the real contracts against the backend before changing anything.

Chat (three defects, one root cause):
- every chat endpoint is keyed by the chat id, not the service id. The app
  called POST /chat/start, threw away the id it returned and kept using the
  service id, so every later request 404'd.
- messages arrive as {data, meta}; reading the body as a bare list threw and
  surfaced as an empty conversation.
- the bloc created the chat and then never emitted ChatLoaded (the else hung
  off `if (chat == null)`), leaving a permanent spinner. Sending a message
  emitted nothing at all, so it vanished until reopening.
Messages now render optimistically and roll back if the send fails, and the
screen distinguishes "loading" from "could not open" with a retry.

Appointments:
- a null range1_hour2 parsed as 00:00, so new appointments were born
  "Caducado" and every action was hidden. It now falls back to the start time.
- service requests validate the HTTP status and tolerate an empty body: a 4xx
  was treated as success and a 204 as failure.
- creating a service with no id in the response no longer reports success and
  navigates to a service that does not exist.
- dispatching LoadService from build() looped forever on failure; the three
  detail screens now load once and offer a retry.

Ratings:
- both sides read userScored, so only one of the two could ever rate. The
  client side now reads professionalScored.
- the screen closed before the request finished, killing the provider mid
  flight while addComment swallowed every error. It now waits for confirmation.
- score/reputation parsing tolerates integers and numeric strings instead of
  emptying the review list.

Also: guarded map lookups in ScoreBloc, a nullable name in the search list,
and error states with retry where a failure used to shimmer forever.

Verified against the backend: `accepted` is the status the API expects, so the
suspected spelling bug was a false alarm and was left alone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/service_repository/lib/src/repositories/api_service_repository.dart

@@ -51,27 +51,55 @@ class ApiServiceRepository {
     };
   }
 
-  Future<dynamic> _get(String path) async {
-    final res = await http.get(Uri.parse('$_base$path'), headers: await _headers()).timeout(_kHttpTimeout);
+  /// Rejects error responses and tolerates an empty body.
+  ///
+  /// Neither used to happen: a 4xx was parsed as if it had succeeded, and a
+  /// 204 with no body made `jsonDecode` throw, so a change that *did* apply
+  /// was reported to the user as a failure.
+  dynamic _decode(http.Response res, String action) {
+    if (res.statusCode >= 400) {
+      String detail = '';
+      try {
+        final body = jsonDecode(res.body);
+        if (body is Map && body['message'] != null) {
+          final m = body['message'];
+          detail = m is List ? m.join(', ') : m.toString();
+        }
+      } catch (_) {}
+      throw Exception(
+          '$action falló (${res.statusCode})${detail.isEmpty ? '' : ': $detail'}');
+    }
+    if (res.body.isEmpty) return null;
     return jsonDecode(res.body);
   }
 
+  Future<dynamic> _get(String path) async {
+    final res = await http
+        .get(Uri.parse('$_base$path'), headers: await _headers())
+        .timeout(_kHttpTimeout);
+    return _decode(res, 'La consulta');
+  }
+
   Future<dynamic> _post(String path, Map<String, dynamic> body) async {
-    final res = await http.post(
-      Uri.parse('$_base$path'),
-      headers: await _headers(),
-      body: jsonEncode(body),
-    ).timeout(_kHttpTimeout);
-    return jsonDecode(res.body);
+    final res = await http
+        .post(
+          Uri.parse('$_base$path'),
+          headers: await _headers(),
+          body: jsonEncode(body),
+        )
+        .timeout(_kHttpTimeout);
+    return _decode(res, 'La operación');
   }
 
   Future<dynamic> _patch(String path, Map<String, dynamic> body) async {
-    final res = await http.patch(
-      Uri.parse('$_base$path'),
-      headers: await _headers(),
-      body: jsonEncode(body),
-    ).timeout(_kHttpTimeout);
-    return jsonDecode(res.body);
+    final res = await http
+        .patch(
+          Uri.parse('$_base$path'),
+          headers: await _headers(),
+          body: jsonEncode(body),
+        )
+        .timeout(_kHttpTimeout);
+    return _decode(res, 'La actualización');
   }
 
   ServiceEntity _fromApi(Map<String, dynamic> json) {
@@ -114,7 +142,13 @@ class ApiServiceRepository {
       createdAt: json['created_at']?.toString() ?? DateTime.now().toIso8601String(),
       description: json['description']?.toString() ?? '',
       range1Hour1: parseTime(json['range1_hour1']?.toString()),
-      range1Hour2: parseTime(json['range1_hour2']?.toString()),
+      // The backend often leaves range1_hour2 null. Defaulting it to 00:00
+      // made every service look like it had ended at midnight, so the UI
+      // marked brand new appointments as "Caducado" and hid every action.
+      // Falling back to the start time keeps the comparison meaningful.
+      range1Hour2: json['range1_hour2'] != null
+          ? parseTime(json['range1_hour2'].toString())
+          : parseTime(json['range1_hour1']?.toString()),
       rate: json['rate']?.toString() ?? '0',
       status: intToEnumService(statusIndex),
       location: intToEnum(locationIndex),
@@ -142,7 +176,13 @@ class ApiServiceRepository {
       'longitude': entity.longitude,
       'location_preference': _locationToString[entity.location.index],
     });
-    return data['id']?.toString() ?? '';
+    final id = data is Map ? data['id']?.toString() : null;
+    if (id == null || id.isEmpty) {
+      // Returning '' here used to be reported as success, and the app then
+      // navigated to a service that did not exist.
+      throw Exception('El servidor no devolvió la cita creada');
+    }
+    return id;
   }
 
   Future<void> updateServiceStatus(String serviceId, ServiceStatus newStatus) async {