feat(permissions): single registry for secretary and clinic-doctor permissions

The list of permissionable resources was duplicated in six places that had
already diverged: both permission entities, three admin UI files and the
SecretaryPermissions TypeScript interface. Adding a resource meant editing all
of them, so new pages borrowed an unrelated resource instead — five resource
pages sat on appointment_settings.view and treatment-cases on appointments.view.

PermissionCatalog is now the only place that says which resources and actions
exist. Each entity keeps its own DEFAULT_PERMISSIONS, but as role policy only;
a test asserts those defaults never name a resource the registry doesn't have.

getPermissions() merges the stored JSON over the role defaults, so a resource
added to the registry later resolves to the role default instead of silently
false for every existing row. Explicitly stored values are never overwritten,
and no data migration is needed.

Two asymmetries fixed along the way:
- ClinicDoctorPermission validated writes against its own DEFAULT_PERMISSIONS,
  so services.create/delete could never be stored for an invited doctor.
- DoctorSecretary had no validation at all and would store any key, and it only
  read $patch['resources'] — the admin SecretariesPage sends a flat map, so its
  permission edit silently did nothing. Both entities now accept either shape
  and filter through the registry.

New resources 'resources' and 'treatment' are registered with defaults chosen to
preserve today's effective access, since both pages are currently gated on a
borrowed resource.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/Secretary/Entity/DoctorSecretary.php

@@ -7,6 +7,7 @@ use App\Clinic\Entity\Clinic;
 use App\Doctor\Entity\Doctor;
 use App\Secretary\Repository\DoctorSecretaryRepository;
 use App\Shared\Context\EntityContext;
+use App\Shared\Security\PermissionCatalog;
 use App\Shared\Tenant\TenantOwnedTrait;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Component\Uid\Uuid;
@@ -23,11 +24,20 @@ class DoctorSecretary
     public const OWNER_DOCTOR = EntityContext::TYPE_DOCTOR;
     public const OWNER_CLINIC = EntityContext::TYPE_CLINIC;
 
+    /**
+     * پیش‌فرضِ نقشِ منشی — سیاست، نه ساختار. فهرستِ منابع و اکشن‌ها در
+     * PermissionCatalog است.
+     *
+     * treatment روشن و resources خاموش است تا دسترسیِ امروز عوض نشود: پروندهٔ درمان
+     * تا پیش از این روی appointments.view سوار بود (روشن) و صفحاتِ منابع روی
+     * appointment_settings.view (خاموش).
+     */
     public const DEFAULT_PERMISSIONS = [
         'version'   => 1,
         'resources' => [
             'appointments' => ['view' => true,  'create' => true,  'cancel' => false, 'update_status' => true],
             'patients'     => ['view' => true,  'create' => false, 'update' => false, 'delete' => false],
+            'treatment'    => ['view' => true,  'update' => false],
             'payments'     => ['view' => true,  'create' => false, 'update' => false, 'delete' => false],
             'insurances'   => ['view' => true,  'create' => false, 'update' => false, 'delete' => false],
             'addresses'    => ['view' => true,  'create' => false, 'update' => false, 'delete' => false],
@@ -38,6 +48,7 @@ class DoctorSecretary
             'staff'        => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
             'discounts'    => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
             'sms'          => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
+            'resources'    => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
             'appointment_settings' => ['view' => false, 'update' => false],
             'clinic_doctors' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
             'subscription' => ['view' => false, 'create' => false],
@@ -115,7 +126,11 @@ class DoctorSecretary
     public function getSecretary(): User  { return $this->secretary; }
     public function getOwnerType(): string { return $this->entityType; }
     public function getClinic(): ?Clinic  { return $this->clinic; }
-    public function getPermissions(): array { return $this->permissions ?? self::DEFAULT_PERMISSIONS; }
+    /** همیشه شکلِ کاملِ رجیستری — منبعی که بعد از ساختِ این ردیف اضافه شده، پیش‌فرضِ نقش را می‌گیرد. */
+    public function getPermissions(): array
+    {
+        return PermissionCatalog::merge($this->permissions ?? [], self::DEFAULT_PERMISSIONS);
+    }
     public function getNationalCode(): ?string { return $this->nationalCode; }
     public function getAddress(): ?string { return $this->address; }
     public function isActive(): bool      { return $this->active; }
@@ -136,16 +151,23 @@ class DoctorSecretary
     public function setOnlineShareEnabled(bool $v): self  { $this->onlineShareEnabled = $v; $this->touch(); return $this; }
     public function setOnlineSharePercent(float $v): self { $this->onlineSharePercent = (string) $v; $this->touch(); return $this; }
 
-    /** Deep merge: only provided resources/actions are updated */
+    /**
+     * Deep merge: only provided resources/actions are updated.
+     *
+     * هر دو شکلِ ورودی پذیرفته می‌شود — با envelope و بدون آن. صفحهٔ ادمین نقشهٔ
+     * تخت می‌فرستد و تا پیش از این بی‌صدا نادیده گرفته می‌شد؛ قرینهٔ همین منطق در
+     * ClinicDoctorPermission::mergePermissions است.
+     */
     public function mergePermissions(array $patch): void
     {
-        $current = $this->getPermissions();
+        $current  = $this->getPermissions();
+        $resources = $patch['resources'] ?? $patch;
 
-        if (isset($patch['resources']) && is_array($patch['resources'])) {
-            foreach ($patch['resources'] as $resource => $actions) {
-                if (!is_array($actions)) continue;
+        // قبلاً هر کلیدی پذیرفته و ذخیره می‌شد؛ حالا مثل پزشک فقط منابعِ رجیستری.
+        if (is_array($resources)) {
+            foreach (PermissionCatalog::filterPatch($resources) as $resource => $actions) {
                 foreach ($actions as $action => $value) {
-                    $current['resources'][$resource][$action] = (bool) $value;
+                    $current['resources'][$resource][$action] = $value;
                 }
             }
         }