feat: replace patient messages tab with pinnable notes

Port the tauri AddNoteModal notes feature into the admin patient case-file,
replacing the mislabeled «پیام‌ها» (SMS log) tab with «یادداشت‌ها».

Backend (src/Patient):
- PatientNote entity + repository (record-scoped, pinned-first ordering)
- CRUD endpoints on PatientController: GET /notes, POST /note,
  PATCH /note/{uuid} (edit body + toggle pin), DELETE /note/{uuid}
- author display name captured server-side from the current user
- migration for patient_notes; docs/api/patient.md updated

Frontend (assets/admin):
- NotesTab: compose box, newest/oldest sort, pinned-first list with
  accent rail + pin/edit/delete, edit modal, confirm-delete, empty state
- tab key/label/icon messages -> notes; onAddNote deep-links the notes tab

Tests: PatientNoteTest (create/list-order/edit/pin/delete/validation/ownership),
PatientDetailPage notes cases (render/empty/pin/create).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/Patient/Controller/PatientController.php

@@ -53,6 +53,7 @@ class PatientController extends BaseController
         private readonly \App\Patient\Repository\PatientAttachmentRepository $attachmentRepo,
         private readonly \App\Patient\Repository\PatientMedicalRecordRepository $medicalRepo,
         private readonly \App\Patient\Repository\PatientMessageRepository $messageRepo,
+        private readonly \App\Patient\Repository\PatientNoteRepository $noteRepo,
         private readonly \App\Patient\Repository\PatientCallRepository $callRepo,
         private readonly \App\Shared\Service\FileUploadService $fileUpload,
         private readonly \App\Payment\Repository\PaymentRepository $paymentRepo,
@@ -340,6 +341,87 @@ class PatientController extends BaseController
         return $this->success(['message' => 'پیام حذف شد']);
     }
 
+    // ── Notes (یادداشت‌ها) ─────────────────────────────────────────────────────
+    //
+    // Personal staff memos on a record; shared with everyone who owns the record.
+    // The author's display name is captured at write time (survives user deletion).
+
+    #[Route('/api/v1/patient/{uuid}/notes', methods: ['GET'])]
+    public function listNotes(string $uuid, #[CurrentUser] User $user): JsonResponse
+    {
+        [$entityType, $entityId] = $this->resolveEntity($user);
+        $record = $this->recordRepo->findByUuid($uuid);
+        if ($record === null || !$this->ownsRecord($record, $entityType, $entityId)) {
+            return $this->error(ErrorCodes::ERR_PATIENT_NOT_FOUND, ErrorCodes::message(ErrorCodes::ERR_PATIENT_NOT_FOUND), 404);
+        }
+
+        return $this->success(array_map(
+            fn(\App\Patient\Entity\PatientNote $n) => $n->toArray(),
+            $this->noteRepo->findByRecord($record)
+        ));
+    }
+
+    #[Route('/api/v1/patient/{uuid}/note', methods: ['POST'])]
+    public function createNote(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
+    {
+        [$entityType, $entityId] = $this->resolveEntity($user);
+        $record = $this->recordRepo->findByUuid($uuid);
+        if ($record === null || !$this->ownsRecord($record, $entityType, $entityId)) {
+            return $this->error(ErrorCodes::ERR_PATIENT_NOT_FOUND, ErrorCodes::message(ErrorCodes::ERR_PATIENT_NOT_FOUND), 404);
+        }
+
+        $data = json_decode($request->getContent(), true) ?? [];
+        $body = trim((string) ($data['body'] ?? ''));
+        if ($body === '') {
+            return $this->error(ErrorCodes::ERR_VALIDATION_001, 'متن یادداشت الزامی است', 422, 'body');
+        }
+
+        $note = new \App\Patient\Entity\PatientNote($record, $body, (bool) ($data['pinned'] ?? false));
+        $note->setAuthor($user, $user->getRealName() ?? $user->getMobileNumber());
+        $this->noteRepo->save($note);
+
+        return $this->success($note->toArray(), 201);
+    }
+
+    #[Route('/api/v1/patient/note/{uuid}', methods: ['PATCH'])]
+    public function updateNote(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
+    {
+        [$entityType, $entityId] = $this->resolveEntity($user);
+        $note = $this->noteRepo->findByUuid($uuid);
+        if ($note === null || !$this->ownsRecord($note->getRecord(), $entityType, $entityId)) {
+            return $this->error(ErrorCodes::ERR_NOT_FOUND_001, 'یادداشت یافت نشد', 404);
+        }
+
+        $data = json_decode($request->getContent(), true) ?? [];
+        if (array_key_exists('body', $data)) {
+            $body = trim((string) $data['body']);
+            if ($body === '') {
+                return $this->error(ErrorCodes::ERR_VALIDATION_001, 'متن یادداشت الزامی است', 422, 'body');
+            }
+            $note->setBody($body);
+        }
+        if (array_key_exists('pinned', $data)) {
+            $note->setPinned((bool) $data['pinned']);
+        }
+        $this->noteRepo->save($note);
+
+        return $this->success($note->toArray());
+    }
+
+    #[Route('/api/v1/patient/note/{uuid}', methods: ['DELETE'])]
+    public function deleteNote(string $uuid, #[CurrentUser] User $user): JsonResponse
+    {
+        [$entityType, $entityId] = $this->resolveEntity($user);
+        $note = $this->noteRepo->findByUuid($uuid);
+        if ($note === null || !$this->ownsRecord($note->getRecord(), $entityType, $entityId)) {
+            return $this->error(ErrorCodes::ERR_NOT_FOUND_001, 'یادداشت یافت نشد', 404);
+        }
+
+        $this->noteRepo->remove($note);
+
+        return $this->success(['message' => 'یادداشت حذف شد']);
+    }
+
     // ── Medical records (پرونده پزشکی) ────────────────────────────────────────
 
     #[Route('/api/v1/patient/{uuid}/medical-records', methods: ['GET'])]