fix(appointment): one weekly schedule per doctor, place chosen per shift

A doctor working both at their own practice and at a clinic had to write two
independent schedules and neither panel could see the other, so the clinic
showed an empty form even though the doctor had configured their practice.

The schedule is now a single record owned by the doctor. What varies between
days is the place: the context of a shift is read from its location_id, not
from the record it lives in. Booking in a context therefore sees only that
context's days, so a personal-practice secretary still cannot book a clinic
day. The caller's own context decides which addresses they may assign: the
doctor gets every place of theirs, a clinic manager only its own, and shifts
outside their reach are returned for display but preserved verbatim on save.

Existing per-clinic rows are merged by migration; location_id was already
stored on every shift, so no context information is lost.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/api/appointment.md

@@ -1327,6 +1327,10 @@ the JWT firewall, so a valid bearer + `management=1` enables management mode (`n
 Lists every place the doctor can be booked at. The site should show **all** of them, grouped by
 location — picking one and hiding the rest removes real capacity from the doctor.
 
+Since 2026-08 the doctor has a **single** weekly schedule, so this endpoint iterates over the doctor's
+*places* (personal practice + each clinic they belong to) rather than over schedule records, and keeps
+for each place only the shifts whose `location_id` belongs to it. The response shape is unchanged.
+
 ```json
 {
   "success": true,