fix(security): enforce ownership on 4 IDOR read/bind endpoints (M2-M5)

- M2 GET /insurance/{id}: was unguarded; now owner-or-admin (403 otherwise) —
  stops reading another doctor's negotiated price by id enumeration.
- M3 GET /clinic-pro/doctor-address/{id}: add the same owner/admin check the
  sibling PATCH/DELETE already had.
- M4 POST/PATCH /service-item: staff_uuid must belong to the caller's tenant
  (entity_type/entity_id) → 422; stops binding another tenant's staff.
- M5 appointment-settings list endpoints (date-override/holidays/
  available-locations): add the per-doctor ownership check the sibling
  single-record endpoints already enforce.

Regressions (6 negative cases fail without the fixes):
DoctorInsuranceOwnershipTest, DoctorAddressOwnershipTest,
ServiceItemStaffOwnershipTest, AppointmentSettingsListOwnershipTest.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Appointment/Controller/AppointmentSettingsController.php

@@ -148,13 +148,17 @@ class AppointmentSettingsController extends BaseController
     // ── Date Overrides ────────────────────────────────────────────────────────
 
     #[Route('/api/v1/appointment-settings/date-override/list/{doctorUuid}', methods: ['GET'])]
-    public function listOverrides(string $doctorUuid): JsonResponse
+    public function listOverrides(string $doctorUuid, #[CurrentUser] User $user): JsonResponse
     {
         $doctor = $this->doctorRepo->findByUuid($doctorUuid);
         if ($doctor === null) {
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'دکتر یافت نشد', 404);
         }
 
+        if ($doctor->getUser()->getId() !== $user->getId() && !$user->hasRole('ROLE_ADMIN')) {
+            return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
+        }
+
         $overrides = array_map(
             fn(DateOverride $o) => $o->toArray(),
             $this->overrideRepo->findByDoctor($doctor)
@@ -254,13 +258,17 @@ class AppointmentSettingsController extends BaseController
     // ── Holidays ──────────────────────────────────────────────────────────────
 
     #[Route('/api/v1/appointment-settings/holidays/list/{doctorUuid}', methods: ['GET'])]
-    public function listHolidays(string $doctorUuid): JsonResponse
+    public function listHolidays(string $doctorUuid, #[CurrentUser] User $user): JsonResponse
     {
         $doctor = $this->doctorRepo->findByUuid($doctorUuid);
         if ($doctor === null) {
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'دکتر یافت نشد', 404);
         }
 
+        if ($doctor->getUser()->getId() !== $user->getId() && !$user->hasRole('ROLE_ADMIN')) {
+            return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
+        }
+
         $items = array_map(fn(Holiday $h) => $h->toArray(), $this->holidayRepo->findAllByDoctor($doctor));
 
         return $this->success(['data' => $items]);
@@ -347,13 +355,17 @@ class AppointmentSettingsController extends BaseController
     // ── Available Locations ───────────────────────────────────────────────────
 
     #[Route('/api/v1/appointment-settings/available-locations/{doctorUuid}', methods: ['GET'])]
-    public function availableLocations(string $doctorUuid): JsonResponse
+    public function availableLocations(string $doctorUuid, #[CurrentUser] User $user): JsonResponse
     {
         $doctor = $this->doctorRepo->findByUuid($doctorUuid);
         if ($doctor === null) {
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'دکتر یافت نشد', 404);
         }
 
+        if ($doctor->getUser()->getId() !== $user->getId() && !$user->hasRole('ROLE_ADMIN')) {
+            return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
+        }
+
         $clinics    = $this->clinicRepo->findByDoctor($doctor);
         $clinicIds  = array_map(fn(Clinic $c) => $c->getId(), $clinics);
         $clinicMap  = [];

src/ClinicService/Controller/ClinicServiceController.php

@@ -156,9 +156,10 @@ class ClinicServiceController extends BaseController
 
         if (!empty($data['staff_uuid'])) {
             $staff = $this->staffRepo->findByUuid($data['staff_uuid']);
-            if ($staff !== null) {
-                $item->setStaff($staff);
+            if ($staff === null || $staff->getEntityType() !== $entityType || $staff->getEntityId() !== $entityId) {
+                return $this->error(ErrorCodes::ERR_VALIDATION_001, 'پرسنل انتخاب‌شده متعلق به شما نیست', 422, 'staff_uuid');
             }
+            $item->setStaff($staff);
         }
 
         if (isset($data['insurance_covered'])) {
@@ -193,7 +194,13 @@ class ClinicServiceController extends BaseController
         if (isset($data['price_rials']))                          { $item->setPriceRials((int) $data['price_rials']); $priceChanged = true; }
         if (isset($data['active']))                               { $item->setActive((bool) $data['active']); }
         if (array_key_exists('staff_uuid', $data)) {
-            $staff = $data['staff_uuid'] ? $this->staffRepo->findByUuid($data['staff_uuid']) : null;
+            $staff = null;
+            if ($data['staff_uuid']) {
+                $staff = $this->staffRepo->findByUuid($data['staff_uuid']);
+                if ($staff === null || $staff->getEntityType() !== $entityType || $staff->getEntityId() !== $entityId) {
+                    return $this->error(ErrorCodes::ERR_VALIDATION_001, 'پرسنل انتخاب‌شده متعلق به شما نیست', 422, 'staff_uuid');
+                }
+            }
             $item->setStaff($staff);
         }
         if (isset($data['insurance_covered'])) {

src/Doctor/Controller/DoctorController.php

@@ -560,13 +560,17 @@ class DoctorController extends BaseController
     )]
     #[Route('/api/v1/clinic-pro/doctor-address/{id}', methods: ['GET'])]
     #[IsGranted('IS_AUTHENTICATED_FULLY')]
-    public function showAddress(int $id): JsonResponse
+    public function showAddress(int $id, #[CurrentUser] User $user): JsonResponse
     {
         $address = $this->addressRepo->find($id);
         if ($address === null) {
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'آدرس یافت نشد', 404);
         }
 
+        if ($address->getDoctor()?->getUser()->getId() !== $user->getId() && !$user->hasRole('ROLE_ADMIN')) {
+            return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
+        }
+
         return $this->success(['data' => $address->toArray()]);
     }
 

src/Insurance/Controller/InsuranceController.php

@@ -506,13 +506,18 @@ class InsuranceController extends BaseController
     }
 
     #[Route('/api/v1/insurance/{id}', methods: ['GET'])]
-    public function showDoctorInsurance(int $id): JsonResponse
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
+    public function showDoctorInsurance(int $id, #[CurrentUser] User $user): JsonResponse
     {
         $doctorInsurance = $this->doctorInsuranceRepo->find($id);
         if ($doctorInsurance === null) {
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'بیمه پزشک یافت نشد', 404);
         }
 
+        if ($doctorInsurance->getDoctor()->getUser()->getId() !== $user->getId() && !$user->hasRole('ROLE_ADMIN')) {
+            return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
+        }
+
         return $this->success(['data' => $doctorInsurance->toArray()]);
     }