perf(settlement,rating): paginate 3 unbounded list endpoints (M10-M12)

- M10 GET /settlement: was unbounded; add page/limit + countByUser + data.meta.
- M11 GET /admin/comments/pending: paginate findPending + countPending.
- M12 GET /comments/{doctor}: paginate the fetch-joined roots query via
  Paginator(fetchJoinCollection) + countApprovedRootsByDoctor.

All keep the existing { data: { data: [...] } } envelope and add data.meta
(backward compatible). Default limit 50 / max 100.

Regressions: SettlementListPaginationTest, CommentPaginationTest (both fail
without the limits). Also de-flaked SendCodeMobileRateLimitTest (randomised the
IP block so the persistent per-IP limiter buckets don't accumulate across runs).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/Auth/SendCodeMobileRateLimitTest.php

@@ -14,6 +14,9 @@ class SendCodeMobileRateLimitTest extends ApiTestCase
     {
         $this->client->disableReboot();
         $mobile = '0912' . str_pad((string) random_int(0, 9_999_999), 7, '0', STR_PAD_LEFT);
+        // a fresh random IP block per run so the persistent per-IP limiter buckets
+        // don't accumulate across runs and fire early.
+        $ipBase = random_int(1, 250);
 
         $statuses = [];
         for ($i = 0; $i < 6; $i++) {
@@ -21,7 +24,7 @@ class SendCodeMobileRateLimitTest extends ApiTestCase
             $this->client->request(
                 'POST',
                 '/api/v1/user/send-code',
-                server: ['REMOTE_ADDR' => "10.20.30.$i", 'CONTENT_TYPE' => 'application/json'],
+                server: ['REMOTE_ADDR' => "10.$ipBase.30.$i", 'CONTENT_TYPE' => 'application/json'],
                 content: json_encode(['mobile' => $mobile]),
             );
             $statuses[] = $this->client->getResponse()->getStatusCode();

tests/Rating/CommentPaginationTest.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Tests\Rating;
+
+use App\Doctor\Entity\Doctor;
+use App\Rating\Entity\Comment;
+use App\Tests\ApiTestCase;
+
+/**
+ * Both the public per-doctor comment list and the admin pending-comment list
+ * must page rather than return every row.
+ */
+class CommentPaginationTest extends ApiTestCase
+{
+    public function testPublicListPaginates(): void
+    {
+        $doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر');
+        $this->em->persist($doctor);
+        for ($i = 0; $i < 7; $i++) {
+            $this->em->persist((new Comment($this->createUser(), $doctor, "نظر $i"))->approve());
+        }
+        $this->em->flush();
+
+        $this->client->request('GET', '/api/v1/comments/' . $doctor->getUuid() . '?limit=5');
+        $body = json_decode($this->client->getResponse()->getContent(), true);
+
+        $this->assertSame(200, $this->responseCode());
+        $this->assertCount(5, $body['data']['data']);
+        $this->assertSame(7, $body['data']['meta']['totalRecords']);
+    }
+
+    public function testAdminPendingListPaginates(): void
+    {
+        $doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر');
+        $this->em->persist($doctor);
+        $admin = $this->createUser(['ROLE_ADMIN']);
+        for ($i = 0; $i < 7; $i++) {
+            // not approved → pending
+            $this->em->persist(new Comment($this->createUser(), $doctor, "در انتظار $i"));
+        }
+        $this->em->flush();
+
+        $body = $this->authJson('GET', '/api/v1/admin/comments/pending?limit=5', $admin);
+
+        $this->assertSame(200, $this->responseCode());
+        $this->assertCount(5, $body['data']['data']);
+        // pending is global (not per-doctor); db_test may hold others → at least 7
+        $this->assertGreaterThanOrEqual(7, $body['data']['meta']['totalRecords']);
+    }
+}

tests/Settlement/SettlementListPaginationTest.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Tests\Settlement;
+
+use App\Settlement\Entity\Settlement;
+use App\Tests\ApiTestCase;
+
+/**
+ * GET /api/v1/settlement must page rather than return every settlement, exposing
+ * totals in meta without breaking the data.data envelope.
+ */
+class SettlementListPaginationTest extends ApiTestCase
+{
+    public function testPaginatesAndReportsTotals(): void
+    {
+        $user = $this->createUser();
+        for ($i = 0; $i < 7; $i++) {
+            $this->em->persist(new Settlement($user, 100_000));
+        }
+        $this->em->flush();
+
+        $body = $this->authJson('GET', '/api/v1/settlement?limit=5', $user);
+        $this->assertSame(200, $this->responseCode());
+        $this->assertCount(5, $body['data']['data']);
+        $this->assertSame(7, $body['data']['meta']['totalRecords']);
+
+        $page2 = $this->authJson('GET', '/api/v1/settlement?limit=5&page=2', $user);
+        $this->assertCount(2, $page2['data']['data']);
+    }
+}