feat: org-scoped appointments backend, wire appointments page

Add the appointments table, validation, service and CRUD routes
(/api/appointments, RBAC-gated) and the matching frontend data module.
The appointments page now loads and persists real data; KPIs are computed
from it and the schedule/calendar anchor to the real current date.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/index.ts

@@ -5,6 +5,7 @@ import express from "express";
 import { auth } from "./auth.js";
 import { env } from "./env.js";
 import { errorHandler, notFound } from "./middleware/error.js";
+import { appointmentsRouter } from "./routes/appointments.js";
 import { notesRouter } from "./routes/notes.js";
 import { patientsRouter } from "./routes/patients.js";
 
@@ -45,6 +46,7 @@ app.get("/health", (_req, res) => {
 
 app.use("/api/patients", patientsRouter);
 app.use("/api/notes", notesRouter);
+app.use("/api/appointments", appointmentsRouter);
 
 app.use(notFound);
 app.use(errorHandler);
@@ -54,4 +56,5 @@ app.listen(env.PORT, () => {
   console.log(`  • auth:     /api/auth/*  (frontend origin: ${env.FRONTEND_URL})`);
   console.log(`  • patients: /api/patients`);
   console.log(`  • notes:    /api/notes`);
+  console.log(`  • appts:    /api/appointments`);
 });