refactor(booking): extract ServiceBookingCalculator from the controller

"Allowed duration of a service combination" lived inside
AppointmentController::serviceSlots(). Three upcoming callers need the same
computation (PATCH duration validation, service-aware reschedule, reserve
conversion); copying it would mean four variants with four different edge-case
behaviours.

The extraction is behaviour-preserving: BaseController::error() and
ExceptionSubscriber emit an identical envelope, so returning $this->error() was
replaced by throwing AppException with the same code/message/field.

Tenant ownership now goes through TenantOwnershipChecker::belongsToPair() (the
documented single point) instead of an inline section pair comparison. The repo
property is named itemRepo on purpose: TenantLookupInventoryTest only counts
recognised property names, so any other name would slip past the safety net.

The naive duration sum is kept deliberately — switching to solo/additional
minutes is task 04 and changes one line here.

Task: docs/new_feture/taskes/task-00-service-mode-completion/
Slot-mode contract: unchanged (--group=slot-mode-frozen green)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/Shared/TenantLookupInventoryTest.php

@@ -35,8 +35,11 @@ class TenantLookupInventoryTest extends TestCase
      * @var array<string, int>
      */
     private const REVIEWED = [
-        // assertServicesMatchContext در هر سه مسیر (اسلات سرویسی، ثبت، و خودِ گارد)
-        'src/Appointment/Controller/AppointmentController.php'      => 3,
+        // assertServicesMatchContext (مسیر ثبت نوبت) + خودِ گارد. جست‌وجوی مسیرِ اسلاتِ
+        // سرویسی به ServiceBookingCalculator منتقل شد و همان‌جا شمرده می‌شود.
+        'src/Appointment/Controller/AppointmentController.php'      => 2,
+        // TenantOwnershipChecker::belongsToPair() روی هر uuid، پیش از هر بررسی دیگر
+        'src/Appointment/Service/ServiceBookingCalculator.php'      => 2,
         // TenantOwnershipChecker روی بخش/سرویس/پرسنل و فهرست سرویس‌ها
         'src/Appointment/Controller/MyAppointmentsController.php'   => 1,
         // ownsSession / getEntityType روی صورتحساب، پرونده و مطالبه