refactor: take the three risky rows back to the plan, without the bugs they invited

All three were deviations I had argued for. Reversing them as asked, each in
the shape the plan wanted and with the failure it would otherwise cause closed.

consume now catches the unique-constraint violation, as specified, instead of
relying only on a read-before-insert. The read stays for the ordinary path, but
it never closed the race — only the unique key does. What made the catch
dangerous is that Doctrine closes the EntityManager on a constraint violation
and the rest of the request dies with it, so the catch resets the registry.
Without that, "already consumed" would surface as an unrelated 500. A test
inserts the ledger row from a second connection and then asks the service to
consume: it returns true, the manager is still open, and exactly one session is
taken.

Cancellation is one transaction now: status, capacity release, credit refund,
penalty and the timeline row commit together. An appointment marked cancelled
whose capacity was never released is the worst of both — the patient has no
appointment and nobody can take the slot. Notification stays outside the
commit, because an SMS cannot be rolled back and must not sit inside something
that can. A test with an SMS provider that always throws proves the
cancellation still commits.

The ledger's running balance is computed in the UI from the rows on screen. The
server still sends its own and remains the reference; the point of computing it
here is that the column now reflects the rows the user is actually looking at,
so a truncated list shows up as a mismatch rather than as a number nobody can
check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

assets/admin/pages/PatientPackageLedgerPage.tsx

@@ -1,4 +1,4 @@
-import React, { useState } from 'react';
+import React, { useMemo, useState } from 'react';
 import { Link, useParams } from 'react-router-dom';
 import PageHeader from '../components/ui/PageHeader';
 import DataTable, { type Column } from '../components/ui/DataTable';
@@ -32,6 +32,24 @@ export default function PatientPackageLedgerPage() {
   const [delta, setDelta] = useState(1);
   const [reason, setReason] = useState('');
 
+  /**
+   * مانده تجمعی از روی همان ردیف‌هایی که نمایش داده می‌شوند.
+   *
+   * دفتر append-only و به ترتیب زمان است، پس جمعِ تجمعی روی همین آرایه دقیقاً همان
+   * چیزی است که سرور می‌گوید — و اگر نبود، یعنی فهرست ناقص رسیده.
+   */
+  const runningBalance = useMemo(() => {
+    const out: Record<string, number> = {};
+    let total = 0;
+
+    for (const row of [...(ledger?.rows ?? [])].sort((a, b) => a.created_at - b.created_at)) {
+      total += row.delta;
+      out[row.uuid] = total;
+    }
+
+    return out;
+  }, [ledger?.rows]);
+
   const columns: Column<CreditLedgerRow>[] = [
     {
       key: 'created_at',
@@ -55,7 +73,12 @@ export default function PatientPackageLedgerPage() {
     {
       key: 'running_balance',
       header: 'مانده',
-      render: (r) => <span style={{ fontSize: 13 }}>{r.running_balance}</span>,
+      // ⚠️ در UI جمع می‌شود، نه از سرور خوانده.
+      //
+      // سرور `running_balance` را هم می‌فرستد و همان مرجع است؛ این ستون **بازتاب**
+      // همان ردیف‌هایی است که کاربر می‌بیند. اگر این عدد با عددِ سرور نخواند، یعنی
+      // فهرست ناقص است — و همان اختلاف، خودش نشانه است.
+      render: (r) => <span style={{ fontSize: 13 }}>{runningBalance[r.uuid] ?? r.running_balance}</span>,
     },
     {
       key: 'reason',