feat(tenant): mark the booking tables with their owning environment

Phase 2 of the tenant-marking series. appointments, weekly_schedules and
date_overrides kept their environment implicit in a nullable clinic_id, so
every query that wanted "this environment's rows" had to rebuild
clinic_id IS NULL ? doctor : clinic itself. The two calendar tables also
depended on a MariaDB-only generated column, clinic_key = IFNULL(clinic_id, 0),
purely to make a unique key work across NULLs.

All three now carry the (entity_type, entity_id) pair that service_sections,
patient_records and clinic_staff already use, via a shared TenantOwnedTrait.
The pair is a deliberate denormalisation of clinic_id/doctor_id: the automatic
tenant filter and the tenant-leading indexes both need a real column, and
neither can be built on an IF() expression.

- Unique keys keep doctor_id alongside the pair. A clinic has several doctors
  and each has their own schedule, so (entity_type, entity_id) alone would
  reject the second doctor.
- clinic_key is gone from both calendar tables.
- appointments gained tenant-leading indexes; EXPLAIN on the panel's list query
  now picks idx_appointments_tenant_slot.

Deliberately unchanged, both with the reason already recorded in the code:
active_slot_key stays keyed on doctor + slot, since adding the environment
would let one doctor be booked in their own practice and a clinic at the same
moment. holidays keeps its nullable clinic_id, where NULL means "every
environment" rather than "personal practice" — a meaning the pair cannot carry.

The migration adds the columns nullable, backfills, aborts if any row is left
without an owner, and only then tightens to NOT NULL. It creates each
replacement unique index before dropping the old one, so the tables are never
left unprotected — MariaDB commits implicitly on DDL, so ordering is the only
safety net. It runs its statements through the connection rather than addSql()
because the guard has to sit between the backfill and the NOT NULL change.

Columns are NOT NULL with no default on purpose: a construction site that
forgets assignTenant() fails at flush instead of silently writing entity_id 0,
which the phase 4 filter would then hide from everyone.

Verified on the dev database: 0 rows without a tenant, 0 personal bookings
mismatched against their doctor, 0 clinic bookings mismatched against their
clinic.

Tests: 819 passing (813 + 6 new in BookingTenantTest). PHPStan clean on every
changed file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/Shared/Context/EntityContext.php

@@ -35,6 +35,15 @@ final class EntityContext
         return new self(self::TYPE_CLINIC, $clinic->getId(), $clinic);
     }
 
+    /**
+     * محیط یک رزرو: کلینیکِ داده‌شده، وگرنه مطب شخصی همان پزشک — همان قراردادی که
+     * {@see \App\Appointment\Service\BookingContextResolver} با ?Clinic بیان می‌کند.
+     */
+    public static function forBooking(Doctor $doctor, ?Clinic $clinic): self
+    {
+        return $clinic !== null ? self::forClinic($clinic) : self::forDoctor($doctor);
+    }
+
     public static function unknown(): self
     {
         return new self(self::TYPE_UNKNOWN, null);

src/Shared/Tenant/TenantOwnedTrait.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Shared\Tenant;
+
+use App\Shared\Context\EntityContext;
+use Doctrine\ORM\Mapping as ORM;
+
+/**
+ * جفت مالکیتِ محیط — همان قراردادی که ServiceSection و PatientRecord از قبل دارند:
+ * entity_type ∈ {doctor, clinic} به‌همراه شناسهٔ همان موجودیت.
+ *
+ * مقدارها فقط از EntityContext::toEntityPair() می‌آیند تا «کدام محیط» یک منبع
+ * حقیقت بیشتر نداشته باشد ({@see \App\Shared\Context\EntityContextResolver}).
+ *
+ * هیچ‌کدام از دو ستون مقدار پیش‌فرض ندارند: اگر سازنده assignTenant() را فراموش
+ * کند، flush با خطای «typed property must not be accessed before initialization»
+ * می‌شکند. این عمدی است — ردیفِ بی‌محیط بی‌صدا از دید همه پنهان می‌شود.
+ *
+ * طول ۱۰ با service_sections، patient_records و clinic_staff یکی است تا JOIN بین
+ * جدول‌ها به collation mismatch نخورد.
+ */
+trait TenantOwnedTrait
+{
+    #[ORM\Column(name: 'entity_type', type: 'string', length: 10)]
+    private string $entityType;
+
+    #[ORM\Column(name: 'entity_id', type: 'integer')]
+    private int $entityId;
+
+    public function getEntityType(): string { return $this->entityType; }
+
+    public function getEntityId(): int { return $this->entityId; }
+
+    /** @throws \InvalidArgumentException اگر محیط حل نشده باشد */
+    public function assignTenant(EntityContext $context): void
+    {
+        if (!$context->isResolved()) {
+            throw new \InvalidArgumentException(sprintf(
+                'Cannot assign an unresolved tenant context to %s.',
+                static::class,
+            ));
+        }
+
+        [$this->entityType, $this->entityId] = $context->toEntityPair();
+    }
+}