DEC22: the bound login reaches its own patient wallet (D54)

A bound patient login could not see the patient-namespace wallet its own
invoice QR codes debit from: that namespace was keyed on patient_id and
staff-only, while /wallets resolved only the login's own user wallet.

- GET /my/wallet (patient.wallet, module:finance.billing) resolves the
  caller through PatientUserLinkService::resolvePatient() and redirects
  to the bound record's wallet; no live binding renders a dedicated
  empty state - no balance, no account number, no wallet id.
- WalletController::authorizeTenant() gains the binding branch after the
  tenant check (a binding cannot cross clinics) and after the permission
  door (staff reads cost no extra query); everything else still 404s,
  never 403.
- Sidebar: Care > My wallet (appointments.book_own + finance.billing).
- Visible defects corrected while inspecting the walkthrough: the wallet
  views rendered the layout's flash a second time; tab titles read
  "BITMED - BITMED"; the top-up card and the Top-up button showed on
  wallets that are not the caller's own user wallet, though the form
  credits the caller - both now render only when wallet.user_id is the
  caller.

Tests: PatientWalletAccessTest (8/50) new; focused wallet suites 136
passed + 1 pre-existing skip; full suite 703 tests / 2951 assertions
green (work/phpunit-dec22.txt, 8m56s). Evidence under
outputs/feature-evidence/D54-patient-wallet-access/rev-20261016-001/
(8 screenshots, verification.md, tests.txt). Outline entry D54 at
revision v3 with the D44 note corrected; DEC22 register row flipped to
implemented; CONTINUE.md gains rev-20261016-002.