Take a look at "Should lock methods be callable by the client", which delves into what a thin client (also misnamed as 3-tier) and thick client (misnamed as 2-tier) is, and arguments for why some people believe one option might be required along with counter arguments.
If you get tired and can't read to the end: the end result is that either choice seems to be acceptable at present.
If you don't have time to read through the whole article, the conclusion is 2 or 3 tier is OK to sun. If you don't want to handle connection loose and don't want to send lock cookie to your client, you can go with 3 tier, like what I did.
Regardless of your choice on where to divide the tiers, all solutions to this project are TWO TIER. This is because all you have is a Client and a Server. The choice of implementing only the business actions of Find and Book is still two tier and is still a rich client, maybe slightly poorer than the other choice, but not really thin.
To be a truly thin the client must know NOTHING about the business or data aspects of the system and be only concerned with "presentation", the View in MVC, a browser would be a good choice.
I started out with the "thinner" client, only exposing the Find and Book methods to the client. I switched sides, because I couldn't really justify that choice if required to. The instructions clearly direct you to use a "traditional client-server system" and the server is described as "a data management system". These two requirements are in the section entitled "Overall Architecture". I have never seen a data management system that knew anything about anyone's business logic.
If you wish to make things easier for yourself by ignoring the architectural requirements, you should plan to document your choice very convincingly. There have been a few people who have passed using the "thin" solution, I haven't seen thier choices document, but I suspect it was well written.
If I were marking this assignment, I'd fail any submission that did not provide a "data management system" and a "traditional client-server" since its explicitly required.