fix(dashboard): make the staff dashboard show the operator's actual work

Every number on it was zero. "نوبت‌های امروز من" counted appointments where
appointments.staff_id matches — a column no booking path fills by default, and
which is NULL on every row in the database. "سرویس‌های من" read only direct
service assignment, so an operator whose whole job comes from a treatment
protocol was told they had no services. The landing page of the only role that
has one data page said, in effect, that they had nothing to do — while they had
two sessions booked that day.

Today's work now comes from TreatmentSessionRepository::findTodayForStaff, the
same queue rule the sessions page uses, so there is one definition of "my work
today" rather than two that disagree. Services are the union of direct
assignment and protocol authorisation.

The two stat cards are links to the pages they name; a number with no
destination made the user hunt the sidebar for a page the card had just
mentioned. Each row of the work list opens that session. The avatar moves from
its own full-width card into the header — two lines of text were costing a card
and pushing the day's work below the fold on mobile. The assigned-appointments
table renders only when it has rows.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/Treatment/Repository/TreatmentProtocolRepository.php

@@ -3,6 +3,7 @@
 namespace App\Treatment\Repository;
 
 use App\ClinicService\Entity\ServiceItem;
+use App\Staff\Entity\ClinicStaff;
 use App\Treatment\Entity\TreatmentProtocol;
 use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
 use Doctrine\Persistence\ManagerRegistry;
@@ -27,4 +28,36 @@ class TreatmentProtocolRepository extends ServiceEntityRepository
     {
         return $this->findOneBy(['serviceItem' => $service, 'active' => true]);
     }
+
+    /**
+     * سرویس‌هایی که پروتکلِ فعالشان این پرسنل را مجاز دانسته.
+     *
+     * تخصیصِ مستقیمِ سرویس (`ServiceItemRepository::findByStaff`) این‌ها را نمی‌بیند،
+     * ولی اپراتوری که تمام کارش از پروتکل می‌آید واقعاً همین سرویس‌ها را انجام می‌دهد.
+     *
+     * @return list<ServiceItem>
+     */
+    public function findServicesForStaff(ClinicStaff $staff): array
+    {
+        // ریشه ServiceItem است نه پروتکل: Doctrine اجازه نمی‌دهد entityِ join‌شده را
+        // بدون alias ریشه select کنی.
+        return $this->getEntityManager()->createQueryBuilder()
+            ->select('si')
+            ->from(ServiceItem::class, 'si')
+            ->join(TreatmentProtocol::class, 'p', 'WITH', 'p.serviceItem = si')
+            ->join('p.allowedStaff', 'ps')
+            ->join('si.section', 'sec')
+            ->where('ps.staff = :staff')
+            ->andWhere('p.active = true')
+            ->andWhere('si.active = true')
+            // محیط، وگرنه پرسنلِ یک کلینیک سرویس کلینیک دیگر را می‌بیند.
+            ->andWhere('sec.entityType = :type')
+            ->andWhere('sec.entityId = :id')
+            ->setParameter('staff', $staff)
+            ->setParameter('type', $staff->getEntityType())
+            ->setParameter('id', $staff->getEntityId())
+            ->orderBy('si.name', 'ASC')
+            ->getQuery()
+            ->getResult();
+    }
 }