feat(patients): surface the no-show count, and put the report filters in the URL

The no-show records existed and drove the risk tag, but the patient's file
never showed the number behind it — the operator saw a tag with no evidence.
GET /patient/{uuid}/no-shows returns the count, the policy threshold and the
window, and the banner shows it only when the count is above zero: "0 no-shows"
on every healthy patient's file is an accusation nobody made.

The badge does not block anything and the docs say so. Blocking is an
eligibility policy from task 09 built on the same tag; a clinic that wants to
see the risk but still take a deposit must not have to switch the count off.
A test pins that a tagged patient still books.

Both report pages kept their range and branch in local state, so going back
from a resource lost the report and a shared link opened someone else's
default. They use useUrlState now, like every other list in the panel.

Three tests that were owed:
- the service-level cancellation policy beats the tenant one with no blending,
  checked through the number that comes out rather than through the resolver
- a patient over the no-show threshold can still book
- occupied includes the waiting segment while active does not — if those two
  came back equal the whole utilization report would be pointless

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/Cancellation/CancellationTest.php

@@ -364,6 +364,89 @@ class CancellationTest extends ApiTestCase
 
     // ── جداسازی محیط ────────────────────────────────────────────────────────
 
+    /**
+     * ⭐ سیاست سرویس بر سیاست محیط مقدم است — بدون ترکیب.
+     *
+     * ترکیب («پنجرهٔ رایگانِ محیط با درصدِ سرویس») یعنی هیچ‌کس نتواند بگوید عدد نهایی از
+     * کجا آمد. سرویس اگر سیاست دارد، **همه‌اش** مال اوست.
+     */
+    public function testTheServicePolicyWinsOverTheTenantPolicy(): void
+    {
+        [$user, $section, , $doctor, $patient] = $this->clinicWithPatient();
+        $clinicId = (int) $patient->getEntityId();
+        $service  = $this->service($section);
+
+        // پنجرهٔ محیط یک ساعت است: با ۲۴ ساعت مانده، لغو رایگان می‌شد.
+        $this->savePolicy($user, [
+            'free_window_hours' => 1,
+            'penalty_mode'      => 'percent',
+            'penalty_value'     => 10,
+        ]);
+
+        // پنجرهٔ سرویس ۴۸ ساعت است: همان لغو، جریمه دارد.
+        $saved = $this->authJson('PUT', "/api/v1/service-item/{$service->getUuid()}/cancellation-policy", $user, [
+            'free_window_hours' => 48,
+            'penalty_mode'      => 'percent',
+            'penalty_value'     => 50,
+        ]);
+        self::assertSame(200, $this->responseCode(), json_encode($saved, JSON_UNESCAPED_UNICODE));
+
+        // عددِ نهایی می‌گوید کدام سیاست حاکم بوده: ۰ یعنی محیط، ۵۰٪ یعنی سرویس.
+        $appointment = $this->appointment($doctor, $patient, $service, $clinicId, 24, 4_000_000, 4_000_000);
+
+        $preview = $this->authJson(
+            'GET',
+            "/api/v1/appointment/{$appointment->getUuid()}/cancellation-preview?by=user",
+            $user,
+        );
+
+        self::assertSame(2_000_000, $preview['data']['penalty_rials'], 'سیاست سرویس حاکم است، نه سیاست محیط');
+        self::assertFalse($preview['data']['within_free_window']);
+    }
+
+    /**
+     * ⭐ برچسب پرریسک **مسدود نمی‌کند**.
+     *
+     * مسدودسازی یک قانون `eligibility` جداست؛ کلینیکی که می‌خواهد بیمار پرریسک را ببیند
+     * ولی بیعانه بگیرد، نباید مجبور شود برچسب را خاموش کند.
+     */
+    public function testATaggedPatientCanStillBook(): void
+    {
+        [$user, $section, , $doctor, $patient] = $this->clinicWithPatient();
+        $clinicId = (int) $patient->getEntityId();
+        $service  = $this->service($section);
+
+        $this->savePolicy($user, ['no_show_threshold' => 2]);
+
+        foreach ([1, 2, 3] as $i) {
+            $appointment = $this->appointment($doctor, $patient, $service, $clinicId, -$i * 24);
+            $this->authJson('POST', "/api/v1/appointment/{$appointment->getUuid()}/no-show", $user);
+            self::assertSame(200, $this->responseCode());
+        }
+
+        $summary = $this->authJson('GET', "/api/v1/patient/{$patient->getUuid()}/no-shows", $user);
+
+        self::assertTrue($summary['data']['at_risk']);
+        self::assertSame(3, $summary['data']['count']);
+
+        // و با همین وضعیت، نوبت تازه ثبت می‌شود.
+        $fresh = $this->appointment($doctor, $patient, $service, $clinicId, 48);
+
+        self::assertSame(Appointment::STATUS_CONFIRMED, $fresh->getStatus());
+    }
+
+    public function testAnotherClinicCannotSeeTheNoShowSummary(): void
+    {
+        [$user, , , , $patient] = $this->clinicWithPatient();
+        [$other]                = $this->clinicWithPatient();
+
+        $this->authJson('GET', "/api/v1/patient/{$patient->getUuid()}/no-shows", $other);
+        self::assertSame(404, $this->responseCode());
+
+        $this->authJson('GET', "/api/v1/patient/{$patient->getUuid()}/no-shows", $user);
+        self::assertSame(200, $this->responseCode());
+    }
+
     public function testAnotherClinicCannotPreviewTheCancellation(): void
     {
         [$owner, $section, $address, $doctor, $patient] = $this->clinicWithPatient();