fix(security): enforce ownership on 4 IDOR read/bind endpoints (M2-M5)

- M2 GET /insurance/{id}: was unguarded; now owner-or-admin (403 otherwise) —
  stops reading another doctor's negotiated price by id enumeration.
- M3 GET /clinic-pro/doctor-address/{id}: add the same owner/admin check the
  sibling PATCH/DELETE already had.
- M4 POST/PATCH /service-item: staff_uuid must belong to the caller's tenant
  (entity_type/entity_id) → 422; stops binding another tenant's staff.
- M5 appointment-settings list endpoints (date-override/holidays/
  available-locations): add the per-doctor ownership check the sibling
  single-record endpoints already enforce.

Regressions (6 negative cases fail without the fixes):
DoctorInsuranceOwnershipTest, DoctorAddressOwnershipTest,
ServiceItemStaffOwnershipTest, AppointmentSettingsListOwnershipTest.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Doctor/Controller/DoctorController.php

@@ -560,13 +560,17 @@ class DoctorController extends BaseController
     )]
     #[Route('/api/v1/clinic-pro/doctor-address/{id}', methods: ['GET'])]
     #[IsGranted('IS_AUTHENTICATED_FULLY')]
-    public function showAddress(int $id): JsonResponse
+    public function showAddress(int $id, #[CurrentUser] User $user): JsonResponse
     {
         $address = $this->addressRepo->find($id);
         if ($address === null) {
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'آدرس یافت نشد', 404);
         }
 
+        if ($address->getDoctor()?->getUser()->getId() !== $user->getId() && !$user->hasRole('ROLE_ADMIN')) {
+            return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
+        }
+
         return $this->success(['data' => $address->toArray()]);
     }