Salon booking site that survives a zone outage

Your company runs an online booking site for 8,000 hair salons. Customers book appointments, and salons manage their calendars. Everything runs in one zone of a cloud region. That is 6 app servers behind a load balancer, a Postgres database, and a Redis server that holds login sessions. Last month that zone lost power for 3 hours, and the site was down the whole time.

The region has 3 zones, each in its own building with its own power. The load balancer can send traffic to servers in any of them. The managed database can keep a standby copy in another zone. The standby is updated on every commit and takes over in about 1 minute.

At the Saturday peak the site handles 1,000 requests a second, and one app server handles about 250. After a zone fails, the site may be down for a few minutes, but no confirmed booking may be lost.

Where does each part of the site run, and what happens in the minutes after a zone fails?