feat(migrations): add ownership fields to doctors table for IRIMC import

- Introduced new columns: owner_status, source, source_ref, managed_by, and claimed_at to the doctors table.
- Created indexes for owner_status and source to optimize queries related to unclaimed doctors.

feat(auth): implement SystemOwnerCommand for managing system-owner user

- Added command to create, activate, and deactivate a system-owner user for IRIMC crawler.
- Ensured the user has ROLE_ADMIN to access import endpoints.
- Handled password setting and user status management within the command.

docs/api/doctor.md

@@ -267,6 +267,8 @@ Delete a doctor profile.
 
 > **Side effect:** the doctor's insurance configuration (`tenant_insurances`, `entity_insurance_pricing`, and their `tenant_service_coverages`) is purged in the same request — these reference the doctor via a polymorphic `entity_id` with no DB FK, so the cleanup is enforced in the application.
 
+> **Guard:** a doctor with existing appointments cannot be deleted (the `appointments.doctor_id` FK would otherwise raise a `500`). The endpoint pre-checks and returns `409 ERR_CONFLICT_001` instead.
+
 ### Path Parameters
 | Param | Type | Description |
 |-------|------|-------------|
@@ -286,6 +288,7 @@ Delete a doctor profile.
 | `ERR_AUTH_001` | 401 | Missing token |
 | `ERR_AUTH_006` | 403 | Not admin |
 | `ERR_NOT_FOUND_001` | 404 | Doctor not found |
+| `ERR_CONFLICT_001` | 409 | Doctor has existing appointments and cannot be deleted |
 
 ---