booking: use reloaded session on messaging retry

_msg_gql built its query params (including ses) once before the request,
so the retry after _ensure_refreshed sent fresh cookies with the dead
session token — guaranteed 401, mark_stale, and a poisoned service even
though the credential refresh had succeeded. Build params inside the
request closure like every other retry site.

Also promote the post-refresh retry status from DEBUG to WARNING/INFO so
logs show whether the refreshed session was accepted.

room_cal/service_api/_booking.py

@@ -378,14 +378,15 @@ class _BookingClient:
     }
 
   async def _msg_gql(self, operation_name: str, query: str, variables: dict, *, attempt: int = 1) -> dict:
-    params = {
-      'hotel_id': str(self._hotel_id),
-      'lang': self._lang,
-      'ses': self._session,
-      'source': 'nav',
-      'tlc': '1',
-    }
     async def _do_request() -> httpx.Response:
+      # params built per call so a retry after _ensure_refreshed uses the reloaded session
+      params = {
+        'hotel_id': str(self._hotel_id),
+        'lang': self._lang,
+        'ses': self._session,
+        'source': 'nav',
+        'tlc': '1',
+      }
       return await self._http.post(
         f'{_BASE}/dml/graphql.json',
         params=params,
@@ -402,7 +403,8 @@ class _BookingClient:
       _log.warning('booking _msg_gql %s attempt=%d http=%d body=%.500s', operation_name, attempt, r.status_code, r.text)
       await self._ensure_refreshed(trigger='messaging')
       r = await _do_request()
-      _log.debug('booking _msg_gql %s attempt=%d (after refresh) http=%d', operation_name, attempt, r.status_code)
+      level = logging.WARNING if r.status_code in (400, 401, 403) else logging.INFO
+      _log.log(level, 'booking _msg_gql %s attempt=%d (after refresh) http=%d', operation_name, attempt, r.status_code)
     await self._check_auth(r)
     r.raise_for_status()
     raw = r.json()