feat(settings): complete remaining settings tabs (account, tags, turns)

Fill the three previously-placeholder settings sections so every menu item
is now a real page inside the settings shell:

- حساب کاربری: new authenticated POST /api/v1/user/change-password
  (verifies current password, ≥8 chars, must differ) + account page with a
  profile summary and change-password form.
- برچسب‌ها: new per-tenant TenantTag domain (entity/repo/controller +
  migration) with tenant-scoped CRUD at /api/v1/tenant-tag(s), plus a tags
  management page (list + color + add/edit/delete).
- مدیریت نوبت دهی: export the existing WeeklyScheduleTab from
  DoctorDetailPage and reuse it in a standalone AppointmentSettingsPage
  (current doctor's uuid + addresses).

Wire all three menu entries to their routes. Backend covered by PHPUnit
(change-password, tenant-tag CRUD + ownership); FE covered by Vitest.
API docs updated (auth.md, tag.md).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/pages/SettingsMenuPage.test.tsx

@@ -12,11 +12,10 @@ describe('SettingsMenuPage', () => {
     }
   });
 
-  it('links implemented sections and disables the rest', () => {
+  it('links every implemented section', () => {
     renderWithProviders(<SettingsMenuPage />);
-    // implemented → anchor with href
     expect(screen.getByText('خرید اشتراک').closest('a')).toHaveAttribute('href', '/admin/subscription');
-    // not implemented → disabled button
-    expect(screen.getByText('مدیریت نوبت دهی').closest('button')).toBeDisabled();
+    expect(screen.getByText('مدیریت نوبت دهی').closest('a')).toHaveAttribute('href', '/admin/appointment-settings');
+    expect(screen.getByText('حساب کاربری').closest('a')).toHaveAttribute('href', '/admin/account-settings');
   });
 });