feat(patients): phase B2 — attachments (ضمیمه)

Add patient file attachments: a new PatientAttachment entity (record-scoped,
CASCADE) + repository, and endpoints GET /patient/{uuid}/attachments,
POST /patient/{uuid}/attachment (raw-body upload) and DELETE
/patient/attachment/{uuid} (owner-scoped). Factor the shared raw-body upload
logic into FileUploadService. Wire the "ضمیمه" tab in PatientDetailPage
(upload + list + delete). PHPUnit covers list/delete/ownership; Vitest covers
the tab. API docs updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/pages/PatientDetailPage.test.tsx

@@ -58,4 +58,12 @@ describe('PatientDetailPage (پرونده تب‌دار)', () => {
     fireEvent.click(screen.getByText('پیام‌ها'));
     expect(screen.getByText(/به‌زودی تکمیل می‌شود/)).toBeInTheDocument();
   });
+
+  it('renders the attachments tab with an upload button', async () => {
+    renderDetail();
+    await screen.findByText('ساغر صابری');
+    fireEvent.click(screen.getByText('ضمیمه'));
+    expect(await screen.findByRole('button', { name: /آپلود فایل جدید/ })).toBeInTheDocument();
+    expect(await screen.findByText('هنوز فایلی ضمیمه نشده است.')).toBeInTheDocument();
+  });
 });