fix(security): enforce ownership on GET weekly-schedule (IDOR)

getSchedule returned any doctor's schedule to any authenticated user — the
mutation endpoints (update/delete) already checked owner-or-admin but this GET
did not. Add the same check + regression test (fails without the fix).

src/Appointment/Controller/AppointmentSettingsController.php

@@ -109,7 +109,7 @@ class AppointmentSettingsController extends BaseController
     }
 
     #[Route('/api/v1/appointment-settings/weekly-schedule/{uuid}', methods: ['GET'])]
-    public function getSchedule(string $uuid): JsonResponse
+    public function getSchedule(string $uuid, #[CurrentUser] User $user): JsonResponse
     {
         // Try doctor uuid first, then schedule uuid
         $doctor   = $this->doctorRepo->findByUuid($uuid);
@@ -121,6 +121,10 @@ class AppointmentSettingsController extends BaseController
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'برنامه یافت نشد', 404);
         }
 
+        if ($schedule->getDoctor()->getUser()->getId() !== $user->getId() && !$user->hasRole('ROLE_ADMIN')) {
+            return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
+        }
+
         return $this->success(['data' => $schedule->toArray()]);
     }