fix(doctor): hide deactivated doctors from public site

The public list GET /api/v1/doctors only excluded inactive doctors
when an explicit `active` filter was passed; with no param it returned
everyone (deactivated doctors just ranked lower). Deactivated doctors
(admin toggled active_doctor_appointment off) leaked onto nobat724.

- DoctorRepository::findWithFilters: default (no `active` param) now
  filters activeDoctorAppointment = true. The active=1 (bookable) and
  active=0 (admin, inactive-only) escape hatches are unchanged.
- Doctor::toDetailArray: expose raw `is_active` (= activeDoctorAppointment,
  independent of schedule) so public clients can 404 a deactivated
  doctor's profile page; distinct from `active` (flag && has_schedule).
- Tests + docs/api/doctor.md updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/Doctor/DoctorBookingStateAggregationTest.php

@@ -100,6 +100,24 @@ class DoctorBookingStateAggregationTest extends ApiTestCase
         $this->assertSame('نوبت‌دهی آنلاین غیرفعال است', $data['free_turn']);
     }
 
+    public function testDetailExposesRawIsActiveFlagForDeactivatedDoctor(): void
+    {
+        ['doctor' => $doctor] = $this->makeDoctorWithInactivePersonalAndClinic();
+
+        // فلگ روشن (پیش‌فرض): is_active باید true باشد.
+        $this->client->request('GET', '/api/v1/doctor/' . $doctor->getUuid());
+        $this->assertTrue($this->doctorPayload()['is_active']);
+
+        // ادمین پزشک را غیرفعال می‌کند → is_active=false (مبنای 404 در سایت عمومی).
+        $doctor->setActiveDoctorAppointment(false);
+        $this->em->flush();
+
+        $this->client->request('GET', '/api/v1/doctor/' . $doctor->getUuid());
+        $data = $this->doctorPayload();
+        $this->assertFalse($data['is_active']);
+        $this->assertFalse($data['active']);
+    }
+
     public function testDisabledClinicScheduleDoesNotMaskActivePersonalSchedule(): void
     {
         ['doctor' => $doctor, 'personal' => $personal, 'clinic' => $clinicSchedule]