feat(documents): bind form responses to clinical document instances (CYN-39)

[SiddharthaGF]

Summary

• Add tenant-scoped clinical document aggregate that binds a form response to a patient and encounter (start, detail, list)
• Enforce active catalog definition, open encounter, exact published form-version pinning, actor attribution, and the single/multiple-instance policy per encounter
• Emit document.started audit events and commit the bound draft form response plus its first revision in the same unit-of-work transaction

Test plan

• dotnet cake --target=Check (format + lint + tests) — 293 tests, 0 warnings
• Start document for open encounter + active definition → 201, status=inProgress, bound draft response at the pinned published version, document.started audit
• Duplicate start for a single-instance catalog entry → 409; second start allowed when allowsMultipleInstancesPerEncounter
• Retired definition or non-open encounter → 409; unknown or cross-tenant references → 404
• Missing actor on a catalog entry that requires one → 400

Linear:

• https://linear.app/ailuracode/issue/CYN-39/bind-form-responses-to-clinical-document-instances

Sonar cleanup (same branch)

• refactor(documents): resolve reference checks via dedicated resolver — S107 on ClinicalDocumentService (9→7 ctor params) via new IClinicalDocumentReferenceResolver port + Application impl
• refactor(patients): group search filters into PatientSearchQuery — S107 on PatientsController.SearchAsync
• chore(api): pragma-suppress deliberate allow-any CORS (S5122) with justification
• Verified: dotnet cake --target=Check green (293 tests, 0 warnings); SonarScan reports 0 unresolved issues

[github-actions]

Neon branch ready.