feat(migrations): add ownership fields to doctors table for IRIMC import

- Introduced new columns: owner_status, source, source_ref, managed_by, and claimed_at to the doctors table.
- Created indexes for owner_status and source to optimize queries related to unclaimed doctors.

feat(auth): implement SystemOwnerCommand for managing system-owner user

- Added command to create, activate, and deactivate a system-owner user for IRIMC crawler.
- Ensured the user has ROLE_ADMIN to access import endpoints.
- Handled password setting and user status management within the command.

src/Shared/Constant/ErrorCodes.php

@@ -102,6 +102,7 @@ class ErrorCodes
     public const ERR_GONE          = 'ERR_GONE';
     public const ERR_MOVED         = 'ERR_MOVED';
     public const ERR_ACCESS_DENIED = 'ERR_ACCESS_DENIED';
+    public const ERR_METHOD_NOT_ALLOWED_001 = 'ERR_METHOD_NOT_ALLOWED_001';
 
     public static function message(string $code): string
     {
@@ -162,6 +163,7 @@ class ErrorCodes
             self::ERR_GONE                   => 'این منبع دیگر در دسترس نیست',
             self::ERR_MOVED                  => 'این منبع منتقل شده است',
             self::ERR_ACCESS_DENIED          => 'دسترسی مجاز نیست',
+            self::ERR_METHOD_NOT_ALLOWED_001 => 'متد درخواستی برای این آدرس مجاز نیست',
             default                          => 'خطای ناشناخته',
         };
     }

src/Shared/EventSubscriber/ExceptionSubscriber.php

@@ -2,12 +2,14 @@
 
 namespace App\Shared\EventSubscriber;
 
+use App\Shared\Constant\ErrorCodes;
 use App\Shared\Exception\AppException;
 use Psr\Log\LoggerInterface;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\HttpFoundation\JsonResponse;
-use Symfony\Component\HttpKernel\Event\ExceptionEvent;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\MethodNotAllowedHttpException;
+use Symfony\Component\HttpKernel\Event\ExceptionEvent;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\HttpKernel\Exception\TooManyRequestsHttpException;
 use Symfony\Component\HttpKernel\Exception\UnauthorizedHttpException;
@@ -108,6 +110,21 @@ class ExceptionSubscriber implements EventSubscriberInterface
             return;
         }
 
+        // Bots/scanners and stray preflight hit disallowed methods on public paths (e.g. POST /).
+        // Client errors, not server faults: respond 405 and log at notice so they don't flood
+        // the error channel through the generic fallback below.
+        if ($exception instanceof MethodNotAllowedHttpException) {
+            $this->logger->notice('Method not allowed', [
+                'path'   => $event->getRequest()->getPathInfo(),
+                'method' => $event->getRequest()->getMethod(),
+            ]);
+            $event->setResponse(new JsonResponse(
+                ['success' => false, 'data' => null, 'errors' => [['code' => ErrorCodes::ERR_METHOD_NOT_ALLOWED_001, 'message' => ErrorCodes::message(ErrorCodes::ERR_METHOD_NOT_ALLOWED_001)]]],
+                405
+            ));
+            return;
+        }
+
         // Generic fallback: never leak stack traces or internal details in API responses.
         // The class/message/location go into the log MESSAGE itself so they surface in
         // platforms (e.g. Liara) whose default logger only prints the message string.