fix(doctor): hide deactivated doctors from public site

The public list GET /api/v1/doctors only excluded inactive doctors
when an explicit `active` filter was passed; with no param it returned
everyone (deactivated doctors just ranked lower). Deactivated doctors
(admin toggled active_doctor_appointment off) leaked onto nobat724.

- DoctorRepository::findWithFilters: default (no `active` param) now
  filters activeDoctorAppointment = true. The active=1 (bookable) and
  active=0 (admin, inactive-only) escape hatches are unchanged.
- Doctor::toDetailArray: expose raw `is_active` (= activeDoctorAppointment,
  independent of schedule) so public clients can 404 a deactivated
  doctor's profile page; distinct from `active` (flag && has_schedule).
- Tests + docs/api/doctor.md updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/Doctor/Entity/Doctor.php

@@ -616,6 +616,9 @@ class Doctor
                 'parent_id' => $s->getParent()?->getId() !== null ? (string) $s->getParent()->getId() : null,
             ], $this->specialties->toArray()),
             'active'              => $this->activeDoctorAppointment && $sf['has_schedule'],
+            // فلگ خام فعال/غیرفعال بودن پزشک (مستقل از داشتن برنامه) — کلاینت عمومی
+            // مثل nobat724 با این می‌تواند صفحهٔ پزشک غیرفعال را 404 کند.
+            'is_active'           => $this->activeDoctorAppointment,
             'img'                 => $this->images ?? [],
             'social_media'        => $this->socialMedia,
             'expertise'           => array_map(fn(DoctorService $ds) => [