perf(settlement,rating): paginate 3 unbounded list endpoints (M10-M12)

- M10 GET /settlement: was unbounded; add page/limit + countByUser + data.meta.
- M11 GET /admin/comments/pending: paginate findPending + countPending.
- M12 GET /comments/{doctor}: paginate the fetch-joined roots query via
  Paginator(fetchJoinCollection) + countApprovedRootsByDoctor.

All keep the existing { data: { data: [...] } } envelope and add data.meta
(backward compatible). Default limit 50 / max 100.

Regressions: SettlementListPaginationTest, CommentPaginationTest (both fail
without the limits). Also de-flaked SendCodeMobileRateLimitTest (randomised the
IP block so the persistent per-IP limiter buckets don't accumulate across runs).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/Settlement/SettlementListPaginationTest.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Tests\Settlement;
+
+use App\Settlement\Entity\Settlement;
+use App\Tests\ApiTestCase;
+
+/**
+ * GET /api/v1/settlement must page rather than return every settlement, exposing
+ * totals in meta without breaking the data.data envelope.
+ */
+class SettlementListPaginationTest extends ApiTestCase
+{
+    public function testPaginatesAndReportsTotals(): void
+    {
+        $user = $this->createUser();
+        for ($i = 0; $i < 7; $i++) {
+            $this->em->persist(new Settlement($user, 100_000));
+        }
+        $this->em->flush();
+
+        $body = $this->authJson('GET', '/api/v1/settlement?limit=5', $user);
+        $this->assertSame(200, $this->responseCode());
+        $this->assertCount(5, $body['data']['data']);
+        $this->assertSame(7, $body['data']['meta']['totalRecords']);
+
+        $page2 = $this->authJson('GET', '/api/v1/settlement?limit=5&page=2', $user);
+        $this->assertCount(2, $page2['data']['data']);
+    }
+}