feat(holidays): one official calendar, inherited everywhere

The holiday model was already right — national holidays global, a per-tenant
override in both directions, per-doctor and per-resource exceptions — but
nothing could create a national holiday. The only writer was an import
command, so the calendar the whole product inherits from had no owner.

Three admin-only routes give it one. POST upserts, because `date` is unique
and re-sending a day should rename it rather than surface a raw database
error; PATCH takes only the title, because moving a date means a different
holiday. The system admin has no work environment, so the list endpoint now
returns the calendar with an empty `overrides` for that role instead of the
403 `pair()` would raise — the person who maintains the calendar has to be
able to read it.

Both holiday tabs — the doctor's and the resource's — now open with the
official calendar above their own exceptions, from one shared card rather
than two copies that would drift. Each row can be opted out of with a single
click, which is the existing holiday-override endpoint.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/Resource/Repository/NationalHolidayRepository.php

@@ -48,6 +48,11 @@ class NationalHolidayRepository extends ServiceEntityRepository
         return $map;
     }
 
+    public function findByUuid(string $uuid): ?NationalHoliday
+    {
+        return $this->findOneBy(['uuid' => $uuid]);
+    }
+
     public function findByDate(int $date): ?NationalHoliday
     {
         return $this->findOneBy(['date' => $date]);