feat(treatment): endpoint for a course's calendar and its recorded work

GET /api/v1/treatment-case/{uuid}/plan returns every session with a date and an
is_estimate flag, plus each session's area records — the device readings a staff
member actually logged. Until now nothing exposed either: due_at existed only
for the next session, and TreatmentCase::toArray() serialised sessions without
their areas, so 'what was done' was unreachable outside the staff panel.

Kept separate from GET /treatment-case/{uuid}; that response feeds the edit
modal, which needs neither the calendar nor the areas.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/Treatment/TreatmentCaseEndpointsTest.php

@@ -204,4 +204,37 @@ class TreatmentCaseEndpointsTest extends ApiTestCase
 
         self::assertSame(404, $this->responseCode());
     }
+
+    /** تقویم دوره: همهٔ جلسات با تاریخ، و جزئیات نواحیِ جلسهٔ انجام‌شده. */
+    public function testPlanReturnsEverySessionWithADate(): void
+    {
+        $s = $this->scenario();
+
+        $body = $this->authJson('GET', '/api/v1/treatment-case/' . $s['case']->getUuid() . '/plan', $s['user']);
+
+        self::assertSame(200, $this->responseCode());
+        self::assertSame(
+            $s['case']->getTotalSessions(),
+            count($body['data']['sessions']),
+            'تقویم باید همهٔ جلسات را بدهد، نه فقط آن‌هایی که سررسید نوشته دارند',
+        );
+
+        foreach ($body['data']['sessions'] as $row) {
+            self::assertArrayHasKey('planned_at', $row);
+            self::assertArrayHasKey('is_estimate', $row);
+            // نواحی باید بیایند — «چه کاری انجام شد» همین است.
+            self::assertArrayHasKey('areas', $row);
+        }
+    }
+
+    /** حالت مرزی: پروندهٔ محیط دیگر — تقویم هم مثل بقیه ۴۰۴ می‌گیرد نه ۴۰۳. */
+    public function testPlanOfAnotherTenantIs404(): void
+    {
+        $mine  = $this->scenario();
+        $other = $this->scenario();
+
+        $this->authJson('GET', '/api/v1/treatment-case/' . $other['case']->getUuid() . '/plan', $mine['user']);
+
+        self::assertSame(404, $this->responseCode());
+    }
 }