backend: per-doctor patient visibility, transfer, provider picker & scoped activity

- Add patients.primary_provider_id (FK to user) + migration; persist it through
  create/update and surface it on the Patient shape.
- Scope patient list/get for the `doctor` role to their own panel (with a
  createdBy fallback for legacy rows); admin/owner/member/reception/viewer keep
  seeing every patient.
- Add POST /api/patients/:fileNumber/transfer to reassign a chart (updates the
  provider link + PCP label, records activity, notifies the clinic).
- Add GET /api/staff/providers (any member) listing clinical-capable members for
  the PCP picker and transfer dialog.
- Scope the activity feed: non-admins see only their own actions; owners/admins
  see the whole clinic.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/db/schema/patients.ts

@@ -44,6 +44,12 @@ export const patients = pgTable(
     vitalsTakenAt: text("vitals_taken_at").notNull(),
     vitalsTrend: jsonb("vitals_trend").$type<Trend>().notNull(),
     labTrend: jsonb("lab_trend").$type<Trend>().notNull(),
+    // The clinician responsible for this chart (the patient's "PCP"). Used to
+    // scope what each doctor sees and to transfer a patient between providers.
+    // Nullable: legacy/unassigned rows and patients registered by reception.
+    primaryProviderId: text("primary_provider_id").references(() => user.id, {
+      onDelete: "set null",
+    }),
     createdBy: text("created_by").references(() => user.id, {
       onDelete: "set null",
     }),