feat(appointment): identify admin-booked patient by national code

Admin-side booking (POST /api/v1/my/appointment and
/api/v1/admin/appointment) resolved the patient User by mobile only, so
one person booked under two mobiles produced two User rows — and two
case-files, since PatientRecord is keyed on user_id. National code is the
real unique identity (User.national_code is already unique); a person may
have several mobiles.

Booking now requires + validates patient_national_code and resolves the
patient national-code-first (then mobile) via a shared PatientResolver, so
the case-file stays unique per national code even across mobiles. Reusing a
mobile already bound to a different national code returns 422
ERR_PROFILE_MOBILE_TAKEN. The admin create form and NewAppointmentDrawer
gain a national-code field and send it; both had a dead patient-picker URL
(/api/v1/patient) fixed to the real /api/v1/patients, whose payload already
carries user_national_code for autofill.

Docs (appointment.md, admin.md) and tests updated; new
AppointmentNationalCodeTest covers success, single-file reuse, missing,
invalid, and identity-conflict cases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/Auth/Repository/UserRepository.php

@@ -18,6 +18,11 @@ class UserRepository extends ServiceEntityRepository
         return $this->findOneBy(['mobileNumber' => $mobile]);
     }
 
+    public function findByNationalCode(string $nationalCode): ?User
+    {
+        return $this->findOneBy(['nationalCode' => $nationalCode]);
+    }
+
     public function findByUuid(string $uuid): ?User
     {
         return $this->findOneBy(['uuid' => $uuid]);