feat(patients): surface the no-show count, and put the report filters in the URL

The no-show records existed and drove the risk tag, but the patient's file
never showed the number behind it — the operator saw a tag with no evidence.
GET /patient/{uuid}/no-shows returns the count, the policy threshold and the
window, and the banner shows it only when the count is above zero: "0 no-shows"
on every healthy patient's file is an accusation nobody made.

The badge does not block anything and the docs say so. Blocking is an
eligibility policy from task 09 built on the same tag; a clinic that wants to
see the risk but still take a deposit must not have to switch the count off.
A test pins that a tagged patient still books.

Both report pages kept their range and branch in local state, so going back
from a resource lost the report and a shared link opened someone else's
default. They use useUrlState now, like every other list in the panel.

Three tests that were owed:
- the service-level cancellation policy beats the tenant one with no blending,
  checked through the number that comes out rather than through the resolver
- a patient over the no-show threshold can still book
- occupied includes the waiting segment while active does not — if those two
  came back equal the whole utilization report would be pointless

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/Report/ReportTest.php

@@ -226,6 +226,122 @@ class ReportTest extends ApiTestCase
         self::assertFalse($row['wasted_capacity']);
     }
 
+    /**
+     * ⭐ سنجه‌های واقعی: اشغال شامل انتظار است، «کار مفید» نه.
+     *
+     * فاصلهٔ این دو همان چیزی است که تعریف غلط بخش‌ها را لو می‌دهد؛ اگر هر دو یکی
+     * برگردند، گزارش بی‌فایده است و کسی متوجه نمی‌شود.
+     */
+    public function testOccupiedIncludesTheWaitingSegmentButActiveDoesNot(): void
+    {
+        [$user, , $address] = $this->clinic();
+
+        $type = $this->authJson('POST', '/api/v1/resource-types', $user, [
+            'address_uuid' => $address->getUuid(),
+            'code'         => 'room',
+            'name'         => 'اتاق',
+        ]);
+        self::assertSame(201, $this->responseCode(), json_encode($type, JSON_UNESCAPED_UNICODE));
+
+        $created = $this->authJson('POST', '/api/v1/resource', $user, [
+            'address_uuid' => $address->getUuid(),
+            'type_uuid'    => $type['data']['uuid'],
+            'name'         => 'اتاق ۱',
+        ]);
+        self::assertSame(201, $this->responseCode());
+
+        $resource = $this->em->getRepository(\App\Resource\Entity\ClinicResource::class)
+            ->findOneBy(['uuid' => $created['data']['uuid']]);
+
+        $from  = time() - 2 * 86400;
+        $start = $from + 3600;
+
+        $appointment = $this->bookedAppointment($address, $start, 60);
+
+        // یک ساعت اشغال؛ ولی بیمار فقط ۲۰ دقیقهٔ اولش حاضر است.
+        $this->occupy($resource, $appointment, $start, $start + 3600);
+        $this->segment($appointment, 1, 'ویزیت', $start, $start + 1200, true);
+        $this->segment($appointment, 2, 'انتظار', $start + 1200, $start + 3600, false);
+
+        $body = $this->authJson(
+            'GET',
+            sprintf(
+                '/api/v1/reports/resource-utilization?branch_uuid=%s&from=%d&to=%d',
+                $address->getUuid(),
+                $from,
+                time(),
+            ),
+            $user,
+        );
+
+        self::assertSame(200, $this->responseCode(), json_encode($body, JSON_UNESCAPED_UNICODE));
+
+        $row = $body['data']['rows'][0];
+
+        self::assertSame(60, $row['occupied_minutes'], 'انتظار هم اشغال است');
+        self::assertSame(20, $row['active_minutes'], 'ولی کار مفید نیست');
+    }
+
+    private function bookedAppointment(\App\Doctor\Entity\DoctorAddress $address, int $start, int $minutes): \App\Appointment\Entity\Appointment
+    {
+        $doctorUser = $this->createUser(['ROLE_USER', 'ROLE_DOCTOR']);
+        $doctor     = new \App\Doctor\Entity\Doctor($doctorUser, 'دکتر گزارش');
+        $this->em->persist($doctor);
+
+        $appointment = new \App\Appointment\Entity\Appointment(
+            $doctor,
+            $this->createUser(['ROLE_USER']),
+            $start,
+            $start + $minutes * 60,
+        );
+        $appointment->assignTenantPair('clinic', (int) $address->getClinicId());
+        $appointment->setAddressId($address->getId());
+        $appointment->setPatientName('بیمار گزارش');
+        $appointment->transitionTo(\App\Appointment\Entity\Appointment::STATUS_CONFIRMED);
+
+        $this->em->persist($appointment);
+        $this->em->flush();
+
+        return $appointment;
+    }
+
+    private function occupy(
+        \App\Resource\Entity\ClinicResource $resource,
+        \App\Appointment\Entity\Appointment $appointment,
+        int $from,
+        int $to,
+    ): void {
+        $row = new \App\Appointment\Availability\Entity\ResourceOccupancy(
+            $resource,
+            $from,
+            $to,
+            \App\Appointment\Availability\Entity\ResourceOccupancy::STATUS_BOOKED,
+        );
+        $row->setAppointmentId($appointment->getId());
+
+        $this->em->persist($row);
+        $this->em->flush();
+    }
+
+    private function segment(
+        \App\Appointment\Entity\Appointment $appointment,
+        int $sequence,
+        string $name,
+        int $from,
+        int $to,
+        bool $present,
+    ): void {
+        $this->em->persist(new \App\Appointment\Booking\Entity\AppointmentSegment(
+            $appointment,
+            $sequence,
+            $name,
+            $from,
+            $to,
+            $present,
+        ));
+        $this->em->flush();
+    }
+
     // ── محدودیت بازه و دسترسی ───────────────────────────────────────────────
 
     public function testARangeLongerThanNinetyDaysIsRejected(): void