feat(appointment): identify admin-booked patient by national code

Admin-side booking (POST /api/v1/my/appointment and
/api/v1/admin/appointment) resolved the patient User by mobile only, so
one person booked under two mobiles produced two User rows — and two
case-files, since PatientRecord is keyed on user_id. National code is the
real unique identity (User.national_code is already unique); a person may
have several mobiles.

Booking now requires + validates patient_national_code and resolves the
patient national-code-first (then mobile) via a shared PatientResolver, so
the case-file stays unique per national code even across mobiles. Reusing a
mobile already bound to a different national code returns 422
ERR_PROFILE_MOBILE_TAKEN. The admin create form and NewAppointmentDrawer
gain a national-code field and send it; both had a dead patient-picker URL
(/api/v1/patient) fixed to the real /api/v1/patients, whose payload already
carries user_national_code for autofill.

Docs (appointment.md, admin.md) and tests updated; new
AppointmentNationalCodeTest covers success, single-file reuse, missing,
invalid, and identity-conflict cases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/Appointment/AppointmentCreateReserveTest.php

@@ -44,6 +44,7 @@ class AppointmentCreateReserveTest extends ApiTestCase
             'slot_end'       => $start + 2_400,
             'patient_mobile' => '09' . random_int(100000000, 999999999),
             'patient_name'   => 'مریم اسکندری',
+            'patient_national_code' => '00' . str_pad((string) random_int(0, 99_999_999), 8, '0', STR_PAD_LEFT),
             'service_section_uuid' => $section->getUuid(),
             'service_item_uuid'    => $item->getUuid(),
             'staff_uuid'           => $staff->getUuid(),
@@ -73,6 +74,7 @@ class AppointmentCreateReserveTest extends ApiTestCase
                 'slot_end'       => $day,
                 'patient_mobile' => '09' . random_int(100000000, 999999999),
                 'patient_name'   => $name,
+                'patient_national_code' => '00' . str_pad((string) random_int(0, 99_999_999), 8, '0', STR_PAD_LEFT),
                 'is_reserve'     => true,
             ]);
             self::assertSame(201, $this->responseCode());
@@ -98,6 +100,7 @@ class AppointmentCreateReserveTest extends ApiTestCase
             'slot_end'       => $start + 1_800,
             'patient_mobile' => '09' . random_int(100000000, 999999999),
             'patient_name'   => 'x',
+            'patient_national_code' => '00' . str_pad((string) random_int(0, 99_999_999), 8, '0', STR_PAD_LEFT),
             'service_item_uuid' => 'missing-uuid',
         ]);
         self::assertSame(422, $this->responseCode());