feat(patients): phase B4 — messages (پیام‌ها)

Add a patient message/communication log: a new PatientMessage entity
(record-scoped, CASCADE) + repository, and owner-scoped endpoints
(GET messages, POST message, DELETE message) with a validated channel
(sms/note/call/email). Wire the "پیام‌ها" tab in PatientDetailPage
(send box + list + delete). PHPUnit covers create/list/delete + ownership
+ validation; Vitest covers the tab. API docs updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/Patient/Controller/PatientController.php

@@ -52,10 +52,67 @@ class PatientController extends BaseController
         private readonly \App\Tag\Repository\TenantTagRepository $tenantTagRepo,
         private readonly \App\Patient\Repository\PatientAttachmentRepository $attachmentRepo,
         private readonly \App\Patient\Repository\PatientMedicalRecordRepository $medicalRepo,
+        private readonly \App\Patient\Repository\PatientMessageRepository $messageRepo,
         private readonly \App\Shared\Service\FileUploadService $fileUpload,
         private readonly LoggerInterface             $logger,
     ) {}
 
+    // ── Messages (پیام‌ها) ─────────────────────────────────────────────────────
+
+    #[Route('/api/v1/patient/{uuid}/messages', methods: ['GET'])]
+    public function listMessages(string $uuid, #[CurrentUser] User $user): JsonResponse
+    {
+        [$entityType, $entityId] = $this->resolveEntity($user);
+        $record = $this->recordRepo->findByUuid($uuid);
+        if ($record === null || !$this->ownsRecord($record, $entityType, $entityId)) {
+            return $this->error(ErrorCodes::ERR_PATIENT_NOT_FOUND, ErrorCodes::message(ErrorCodes::ERR_PATIENT_NOT_FOUND), 404);
+        }
+
+        return $this->success(array_map(
+            fn(\App\Patient\Entity\PatientMessage $m) => $m->toArray(),
+            $this->messageRepo->findByRecord($record)
+        ));
+    }
+
+    #[Route('/api/v1/patient/{uuid}/message', methods: ['POST'])]
+    public function createMessage(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
+    {
+        [$entityType, $entityId] = $this->resolveEntity($user);
+        $record = $this->recordRepo->findByUuid($uuid);
+        if ($record === null || !$this->ownsRecord($record, $entityType, $entityId)) {
+            return $this->error(ErrorCodes::ERR_PATIENT_NOT_FOUND, ErrorCodes::message(ErrorCodes::ERR_PATIENT_NOT_FOUND), 404);
+        }
+
+        $data = json_decode($request->getContent(), true) ?? [];
+        $body = trim((string) ($data['body'] ?? ''));
+        if ($body === '') {
+            return $this->error(ErrorCodes::ERR_VALIDATION_001, 'متن پیام الزامی است', 422, 'body');
+        }
+
+        $channel = (string) ($data['channel'] ?? 'sms');
+        if (!in_array($channel, ['sms', 'note', 'call', 'email'], true)) {
+            $channel = 'sms';
+        }
+        $message = new \App\Patient\Entity\PatientMessage($record, $body, $channel);
+        $this->messageRepo->save($message);
+
+        return $this->success($message->toArray(), 201);
+    }
+
+    #[Route('/api/v1/patient/message/{uuid}', methods: ['DELETE'])]
+    public function deleteMessage(string $uuid, #[CurrentUser] User $user): JsonResponse
+    {
+        [$entityType, $entityId] = $this->resolveEntity($user);
+        $message = $this->messageRepo->findByUuid($uuid);
+        if ($message === null || !$this->ownsRecord($message->getRecord(), $entityType, $entityId)) {
+            return $this->error(ErrorCodes::ERR_NOT_FOUND_001, 'پیام یافت نشد', 404);
+        }
+
+        $this->messageRepo->remove($message);
+
+        return $this->success(['message' => 'پیام حذف شد']);
+    }
+
     // ── Medical records (پرونده پزشکی) ────────────────────────────────────────
 
     #[Route('/api/v1/patient/{uuid}/medical-records', methods: ['GET'])]