feat(holidays): one official calendar, inherited everywhere

The holiday model was already right — national holidays global, a per-tenant
override in both directions, per-doctor and per-resource exceptions — but
nothing could create a national holiday. The only writer was an import
command, so the calendar the whole product inherits from had no owner.

Three admin-only routes give it one. POST upserts, because `date` is unique
and re-sending a day should rename it rather than surface a raw database
error; PATCH takes only the title, because moving a date means a different
holiday. The system admin has no work environment, so the list endpoint now
returns the calendar with an empty `overrides` for that role instead of the
403 `pair()` would raise — the person who maintains the calendar has to be
able to read it.

Both holiday tabs — the doctor's and the resource's — now open with the
official calendar above their own exceptions, from one shared card rather
than two copies that would drift. Each row can be opted out of with a single
click, which is the existing holiday-override endpoint.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

assets/admin/components/resources/ResourceExceptionsPanel.tsx

@@ -5,6 +5,7 @@ import PersianDateInput from '../ui/PersianDateInput';
 import { useResourceAvailability, useResourceExceptions } from '../../hooks/useResourceCalendar';
 import { formatDate } from '../../lib/utils';
 import { DAY_LABELS } from './ResourceWorkingHoursPanel';
+import NationalHolidaysCard from '../holidays/NationalHolidaysCard';
 import type { ResourceException } from '../../types';
 
 /** چرا یک روز خالی است — بدون ترجمه، پاسخ خام سرور به کاربر نشان داده می‌شد. */
@@ -50,6 +51,8 @@ export default function ResourceExceptionsPanel({ resourceUuid, canUpdate }: {
 
   return (
     <div style={{ display: 'grid', gap: 16, gridTemplateColumns: 'repeat(auto-fit, minmax(320px, 1fr))', alignItems: 'start' }}>
+      <NationalHolidaysCard canUpdate={canUpdate} />
+
       <ExceptionsCard
         exceptions={exceptions}
         canUpdate={canUpdate}