getSchedule returned any doctor's schedule to any authenticated user — the mutation endpoints (update/delete) already checked owner-or-admin but this GET did not. Add the same check + regression test (fails without the fix).
