perf(settlement,rating): paginate 3 unbounded list endpoints (M10-M12)

- M10 GET /settlement: was unbounded; add page/limit + countByUser + data.meta.
- M11 GET /admin/comments/pending: paginate findPending + countPending.
- M12 GET /comments/{doctor}: paginate the fetch-joined roots query via
  Paginator(fetchJoinCollection) + countApprovedRootsByDoctor.

All keep the existing { data: { data: [...] } } envelope and add data.meta
(backward compatible). Default limit 50 / max 100.

Regressions: SettlementListPaginationTest, CommentPaginationTest (both fail
without the limits). Also de-flaked SendCodeMobileRateLimitTest (randomised the
IP block so the persistent per-IP limiter buckets don't accumulate across runs).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/Auth/SendCodeMobileRateLimitTest.php

@@ -14,6 +14,9 @@ class SendCodeMobileRateLimitTest extends ApiTestCase
     {
         $this->client->disableReboot();
         $mobile = '0912' . str_pad((string) random_int(0, 9_999_999), 7, '0', STR_PAD_LEFT);
+        // a fresh random IP block per run so the persistent per-IP limiter buckets
+        // don't accumulate across runs and fire early.
+        $ipBase = random_int(1, 250);
 
         $statuses = [];
         for ($i = 0; $i < 6; $i++) {
@@ -21,7 +24,7 @@ class SendCodeMobileRateLimitTest extends ApiTestCase
             $this->client->request(
                 'POST',
                 '/api/v1/user/send-code',
-                server: ['REMOTE_ADDR' => "10.20.30.$i", 'CONTENT_TYPE' => 'application/json'],
+                server: ['REMOTE_ADDR' => "10.$ipBase.30.$i", 'CONTENT_TYPE' => 'application/json'],
                 content: json_encode(['mobile' => $mobile]),
             );
             $statuses[] = $this->client->getResponse()->getStatusCode();