feat(permissions): single registry for secretary and clinic-doctor permissions

The list of permissionable resources was duplicated in six places that had
already diverged: both permission entities, three admin UI files and the
SecretaryPermissions TypeScript interface. Adding a resource meant editing all
of them, so new pages borrowed an unrelated resource instead — five resource
pages sat on appointment_settings.view and treatment-cases on appointments.view.

PermissionCatalog is now the only place that says which resources and actions
exist. Each entity keeps its own DEFAULT_PERMISSIONS, but as role policy only;
a test asserts those defaults never name a resource the registry doesn't have.

getPermissions() merges the stored JSON over the role defaults, so a resource
added to the registry later resolves to the role default instead of silently
false for every existing row. Explicitly stored values are never overwritten,
and no data migration is needed.

Two asymmetries fixed along the way:
- ClinicDoctorPermission validated writes against its own DEFAULT_PERMISSIONS,
  so services.create/delete could never be stored for an invited doctor.
- DoctorSecretary had no validation at all and would store any key, and it only
  read $patch['resources'] — the admin SecretariesPage sends a flat map, so its
  permission edit silently did nothing. Both entities now accept either shape
  and filter through the registry.

New resources 'resources' and 'treatment' are registered with defaults chosen to
preserve today's effective access, since both pages are currently gated on a
borrowed resource.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/Clinic/Entity/ClinicDoctorPermission.php

@@ -4,6 +4,7 @@ namespace App\Clinic\Entity;
 
 use App\Clinic\Repository\ClinicDoctorPermissionRepository;
 use App\Doctor\Entity\Doctor;
+use App\Shared\Security\PermissionCatalog;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Component\Uid\Uuid;
 
@@ -18,22 +19,35 @@ use Symfony\Component\Uid\Uuid;
 #[ORM\UniqueConstraint(name: 'uniq_clinic_doctor_permission', columns: ['clinic_id', 'doctor_id'])]
 class ClinicDoctorPermission
 {
+    /**
+     * پیش‌فرضِ نقشِ «پزشکِ عضو کلینیک» — سیاست، نه ساختار. فهرستِ منابع و اکشن‌ها
+     * در PermissionCatalog است و PermissionCatalogTest اجبار می‌کند این آرایه از
+     * آن بیرون نزند.
+     *
+     * پیش‌فرضِ resources و treatment طوری انتخاب شده که دسترسیِ امروزِ پزشک عوض
+     * نشود: تا پیش از این، صفحاتِ منابع روی appointment_settings و پروندهٔ درمان
+     * روی appointments سوار بودند و هر دو برای این نقش روشن‌اند.
+     */
     public const DEFAULT_PERMISSIONS = [
         'version'   => 1,
         'resources' => [
             'appointments'         => ['view' => true,  'create' => true,  'cancel' => true,  'update_status' => true],
             'appointment_settings' => ['view' => true,  'update' => true],
             'patients'             => ['view' => true,  'create' => true,  'update' => true,  'delete' => false],
+            'treatment'            => ['view' => true,  'update' => true],
             'payments'             => ['view' => true,  'create' => false, 'update' => false, 'delete' => false],
-            'services'             => ['view' => true,  'update' => false],
+            'services'             => ['view' => true,  'create' => false, 'update' => false, 'delete' => false],
             'clinic_info'          => ['view' => true,  'update' => false],
             'insurances'           => ['view' => true,  'create' => false, 'update' => false, 'delete' => false],
             'addresses'            => ['view' => true,  'create' => false, 'update' => false, 'delete' => false],
+            'resources'            => ['view' => true,  'create' => true,  'update' => true,  'delete' => true],
             'inventory'            => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
             'tags'                 => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
             'staff'                => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
             'discounts'            => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
             'sms'                  => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
+            'clinic_doctors'       => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
+            'subscription'         => ['view' => false, 'create' => false],
         ],
     ];
 
@@ -79,7 +93,11 @@ class ClinicDoctorPermission
     public function getUuid(): string       { return $this->uuid; }
     public function getClinic(): Clinic     { return $this->clinic; }
     public function getDoctor(): Doctor     { return $this->doctor; }
-    public function getPermissions(): array { return $this->permissions; }
+    /** همیشه شکلِ کاملِ رجیستری — منبعی که بعد از ساختِ این ردیف اضافه شده، پیش‌فرضِ نقش را می‌گیرد. */
+    public function getPermissions(): array
+    {
+        return PermissionCatalog::merge($this->permissions, self::DEFAULT_PERMISSIONS);
+    }
     public function isActive(): bool        { return $this->active; }
     public function getCreatedAt(): int     { return $this->createdAt; }
     public function getUpdatedAt(): int     { return $this->updatedAt; }
@@ -92,24 +110,17 @@ class ClinicDoctorPermission
             return false;
         }
 
-        return (bool) ($this->permissions['resources'][$resource][$action] ?? false);
+        return (bool) ($this->getPermissions()['resources'][$resource][$action] ?? false);
     }
 
     /** ادغام عمقی — فقط منابع/اکشن‌هایی که ارسال شده‌اند تغییر می‌کنند. */
     public function mergePermissions(array $patch): void
     {
-        $current  = $this->permissions;
-        $resources = $patch['resources'] ?? $patch;
+        $current = $this->getPermissions();
 
-        foreach ($resources as $resource => $actions) {
-            if (!is_array($actions) || !isset(self::DEFAULT_PERMISSIONS['resources'][$resource])) {
-                continue;
-            }
+        foreach (PermissionCatalog::filterPatch($patch['resources'] ?? $patch) as $resource => $actions) {
             foreach ($actions as $action => $value) {
-                if (!array_key_exists($action, self::DEFAULT_PERMISSIONS['resources'][$resource])) {
-                    continue;
-                }
-                $current['resources'][$resource][$action] = (bool) $value;
+                $current['resources'][$resource][$action] = $value;
             }
         }
 
@@ -131,7 +142,7 @@ class ClinicDoctorPermission
             'doctor_uuid' => $this->doctor->getUuid(),
             'doctor_name' => $this->doctor->getName(),
             'active'      => $this->active,
-            'permissions' => $this->permissions,
+            'permissions' => $this->getPermissions(),
             'created_at'  => $this->createdAt,
             'updated_at'  => $this->updatedAt,
         ];