feat(doctor): claim captcha+mobile, owner profile delete, admin map zoom fix

- DoctorClaimController: ALTCHA CaptchaGuard on /claim (dev no-op via
  ALTCHA_ENABLED=false); optional `mobile` field must match the logged-in
  user's number (422 ERR_CONFLICT_001 on mismatch)
- DoctorController::delete: now IS_AUTHENTICATED_FULLY — admin (any) or the
  owner of a claimed profile (IDOR-guarded); FK appointment guard kept
- DoctorDetailPage address map: MapController calls map.invalidateSize()
  before flyTo (fixes needing to pick a city twice on a freshly-mounted map);
  geocode retries once (nominatim empty/429 on first hit)
- tests: mobile mismatch, owner-delete allowed + others 403, unclaimed not
  deletable by random user
- docs: doctor-claim.md (mobile+captcha), doctor.md (delete permission)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/Doctor/Controller/DoctorController.php

@@ -368,14 +368,20 @@ class DoctorController extends BaseController
         ]
     )]
     #[Route('/api/v1/doctor/{uuid}', methods: ['DELETE'])]
-    #[IsGranted('ROLE_ADMIN')]
-    public function delete(string $uuid): JsonResponse
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
+    public function delete(string $uuid, #[CurrentUser] User $user): JsonResponse
     {
         $doctor = $this->doctorRepo->findByUuid($uuid);
         if ($doctor === null) {
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'دکتر یافت نشد', 404);
         }
 
+        // ادمین هر پروفایلی را؛ مالک فقط پروفایلِ claimedِ خودش را حذف می‌کند (ضد IDOR)
+        $isOwner = $doctor->getOwnerStatus() === 'claimed' && $doctor->getUser()->getId() === $user->getId();
+        if (!$user->hasRole('ROLE_ADMIN') && !$isOwner) {
+            return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'اجازهٔ حذف این پروفایل را ندارید', 403);
+        }
+
         if ($this->appointmentRepo->count(['doctor' => $doctor]) > 0) {
             return $this->error(ErrorCodes::ERR_CONFLICT_001, 'این پزشک نوبت ثبت‌شده دارد و قابل حذف نیست', 409);
         }