feat(patients): phase B3 — medical records (پرونده پزشکی)

Add patient medical-exam entries: a new PatientMedicalRecord entity
(record-scoped, CASCADE) + repository, and owner-scoped CRUD endpoints
(GET list, POST create, PATCH, DELETE) under /api/v1/patient. Wire the
"پرونده پزشکی" tab in PatientDetailPage (list + add/edit modal with title,
date and notes + delete). PHPUnit covers CRUD + ownership + validation;
Vitest covers the tab. API docs updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/Patient/Controller/PatientController.php

@@ -51,10 +51,96 @@ class PatientController extends BaseController
         private readonly \App\ClinicInvitation\Repository\ClinicDoctorInvitationRepository $invitationRepo,
         private readonly \App\Tag\Repository\TenantTagRepository $tenantTagRepo,
         private readonly \App\Patient\Repository\PatientAttachmentRepository $attachmentRepo,
+        private readonly \App\Patient\Repository\PatientMedicalRecordRepository $medicalRepo,
         private readonly \App\Shared\Service\FileUploadService $fileUpload,
         private readonly LoggerInterface             $logger,
     ) {}
 
+    // ── Medical records (پرونده پزشکی) ────────────────────────────────────────
+
+    #[Route('/api/v1/patient/{uuid}/medical-records', methods: ['GET'])]
+    public function listMedicalRecords(string $uuid, #[CurrentUser] User $user): JsonResponse
+    {
+        [$entityType, $entityId] = $this->resolveEntity($user);
+        $record = $this->recordRepo->findByUuid($uuid);
+        if ($record === null || !$this->ownsRecord($record, $entityType, $entityId)) {
+            return $this->error(ErrorCodes::ERR_PATIENT_NOT_FOUND, ErrorCodes::message(ErrorCodes::ERR_PATIENT_NOT_FOUND), 404);
+        }
+
+        return $this->success(array_map(
+            fn(\App\Patient\Entity\PatientMedicalRecord $m) => $m->toArray(),
+            $this->medicalRepo->findByRecord($record)
+        ));
+    }
+
+    #[Route('/api/v1/patient/{uuid}/medical-record', methods: ['POST'])]
+    public function createMedicalRecord(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
+    {
+        [$entityType, $entityId] = $this->resolveEntity($user);
+        $record = $this->recordRepo->findByUuid($uuid);
+        if ($record === null || !$this->ownsRecord($record, $entityType, $entityId)) {
+            return $this->error(ErrorCodes::ERR_PATIENT_NOT_FOUND, ErrorCodes::message(ErrorCodes::ERR_PATIENT_NOT_FOUND), 404);
+        }
+
+        $data  = json_decode($request->getContent(), true) ?? [];
+        $title = trim((string) ($data['title'] ?? ''));
+        if ($title === '') {
+            return $this->error(ErrorCodes::ERR_VALIDATION_001, 'عنوان معاینه الزامی است', 422, 'title');
+        }
+
+        $body       = isset($data['body']) ? trim((string) $data['body']) : null;
+        $recordedAt = isset($data['recorded_at']) && $data['recorded_at'] !== '' ? (int) $data['recorded_at'] : null;
+
+        $medical = new \App\Patient\Entity\PatientMedicalRecord($record, $title, $body ?: null, $recordedAt);
+        $this->medicalRepo->save($medical);
+
+        return $this->success($medical->toArray(), 201);
+    }
+
+    #[Route('/api/v1/patient/medical-record/{uuid}', methods: ['PATCH'])]
+    public function updateMedicalRecord(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
+    {
+        [$entityType, $entityId] = $this->resolveEntity($user);
+        $medical = $this->medicalRepo->findByUuid($uuid);
+        if ($medical === null || !$this->ownsRecord($medical->getRecord(), $entityType, $entityId)) {
+            return $this->error(ErrorCodes::ERR_NOT_FOUND_001, 'رکورد پزشکی یافت نشد', 404);
+        }
+
+        $data = json_decode($request->getContent(), true) ?? [];
+        if (isset($data['title'])) {
+            $t = trim((string) $data['title']);
+            if ($t === '') {
+                return $this->error(ErrorCodes::ERR_VALIDATION_001, 'عنوان معاینه الزامی است', 422, 'title');
+            }
+            $medical->setTitle($t);
+        }
+        if (array_key_exists('body', $data)) {
+            $b = trim((string) ($data['body'] ?? ''));
+            $medical->setBody($b === '' ? null : $b);
+        }
+        if (isset($data['recorded_at']) && $data['recorded_at'] !== '') {
+            $medical->setRecordedAt((int) $data['recorded_at']);
+        }
+
+        $this->medicalRepo->save($medical);
+
+        return $this->success($medical->toArray());
+    }
+
+    #[Route('/api/v1/patient/medical-record/{uuid}', methods: ['DELETE'])]
+    public function deleteMedicalRecord(string $uuid, #[CurrentUser] User $user): JsonResponse
+    {
+        [$entityType, $entityId] = $this->resolveEntity($user);
+        $medical = $this->medicalRepo->findByUuid($uuid);
+        if ($medical === null || !$this->ownsRecord($medical->getRecord(), $entityType, $entityId)) {
+            return $this->error(ErrorCodes::ERR_NOT_FOUND_001, 'رکورد پزشکی یافت نشد', 404);
+        }
+
+        $this->medicalRepo->remove($medical);
+
+        return $this->success(['message' => 'رکورد پزشکی حذف شد']);
+    }
+
     // ── Attachments (ضمیمه) ───────────────────────────────────────────────────
 
     #[Route('/api/v1/patient/{uuid}/attachments', methods: ['GET'])]