feat(policy): six-category policy engine wired into the booking flow

Rules become data instead of code: a clinic can say "laser under 18 requires
parental consent" without a deploy.

Engine
- Policy / PolicyVersionLog entities, closed field/operator/effect lists per
  category (PolicySchema), condition validation at write time
- PolicyResolver: priority -> specificity -> age, combining effects by
  veto / max / sum / union
- A missing fact fails its clause instead of silently passing it
- Policies are drafts until activated, and are versioned rather than edited

Wiring
- selection -> ServiceSelectionValidator
- eligibility + spacing -> BookingPolicyGuard, at hold time not confirm time
- resource + timing -> AppointmentPlanBuilder, including template-less services
- pricing -> PricingEngine, alongside (not replacing) the manual discount

The condition column is named condition_json: `condition` is a MariaDB keyword
and broke every INSERT.

Tests: 17 in tests/Policy including NoPolicyRegressionTest, which pins that a
clinic with no policies sees byte-identical output to task 08.
Docs: docs/api/policy.md (real captured JSON) + docs/architecture/policy-engine.md.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/api/pricing.md

@@ -135,3 +135,22 @@ ddev exec php bin/phpunit tests/Pricing   # ۱۲ تست
 مهم‌ترینش `testBookedAppointmentKeepsItsOriginalInvoiceAfterAPriceChange` است: نوبت ثبت
 می‌شود، قیمت سرویس دو برابر می‌شود، `quote` عدد جدید می‌دهد و فاکتور نوبت **همان عدد
 قبلی** را. بدون آن، قانون پنجم فقط یک ادعاست.
+
+---
+
+## قوانین دستهٔ «قیمت»
+
+تخفیفی که موتور قوانین می‌دهد **کنار** تخفیف دستیِ درخواست می‌نشیند نه به‌جایش، و
+شناسه و نسخهٔ هر قانون در `breakdown.sources.applied_policies` ثبت می‌شود:
+
+```json
+"breakdown": {
+  "sources": {
+    "applied_policies": [
+      { "uuid": "…", "name": "تخفیف همین سرویس", "version": 2 }
+    ]
+  }
+}
+```
+
+جزئیات دسته‌ها و اثرها: [policy.md](policy.md)