backend: per-doctor patient visibility, transfer, provider picker & scoped activity

- Add patients.primary_provider_id (FK to user) + migration; persist it through
  create/update and surface it on the Patient shape.
- Scope patient list/get for the `doctor` role to their own panel (with a
  createdBy fallback for legacy rows); admin/owner/member/reception/viewer keep
  seeing every patient.
- Add POST /api/patients/:fileNumber/transfer to reassign a chart (updates the
  provider link + PCP label, records activity, notifies the clinic).
- Add GET /api/staff/providers (any member) listing clinical-capable members for
  the PCP picker and transfer dialog.
- Scope the activity feed: non-admins see only their own actions; owners/admins
  see the whole clinic.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/lib/patient-validation.ts

@@ -55,6 +55,11 @@ export const patientInputSchema = z.object({
   age: z.number().int().min(0).max(150),
   sex: z.enum(["M", "F"]),
   pcp: z.string(),
+  // Optional link to the responsible clinician (user id). Empty string ⇒ null.
+  primaryProviderId: z.preprocess(
+    (v) => (v === "" ? null : v),
+    z.string().nullable().optional(),
+  ),
   status: z.enum(["active", "inpatient", "discharged"]),
   initials: z.string().trim().min(1).max(4),
   allergies: z.array(allergySchema).default([]),