fix(permissions): make the addresses resource real instead of decorative

A full role-by-role sweep (9 roles x 18 endpoints against the running app) showed
the addresses toggles in the owner's permission form controlled nothing. Grep
confirms it: no gate anywhere referenced 'addresses'. The panel's address list was
gated on appointment_settings.view instead — the same borrowed-permission pattern
already fixed for resources and treatment.

GET /api/v1/addresses now gates on addresses.view.

The resource drops to view-only. Creating, updating and deleting an address in
ClinicController is explicitly owner-or-admin
($clinic->getUser()->getId() !== $user->getId()), so those three actions could
never be delegated to a secretary or an invited doctor no matter what the form
said. Both role defaults narrow to ['view' => true] to match, and stored JSON
keeps its old keys harmlessly since merge only reads registry keys.

This widens secretary access: addresses.view defaults to true while
appointment_settings.view defaults to false, so secretaries who could not list
addresses now can. That is deliberate and costs no confidentiality — the same
addresses are already served anonymously from
GET /api/v1/clinic/{uuid}/addresses, which is whitelisted in security.yaml.

Verified live in three states: default 200, addresses.view off 403, and
addresses off with appointment_settings on still 403, proving the borrow is gone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/api/clinic.md

@@ -401,7 +401,7 @@ The envelope is always returned in full (`{version, resources}`); it is never fl
     "treatment":            { "view": true, "update": true },
     "payments":             { "view": true, "create": false, "update": false, "delete": false },
     "insurances":           { "view": true, "create": false, "update": false, "delete": false },
-    "addresses":            { "view": true, "create": false, "update": false, "delete": false },
+    "addresses":            { "view": true },
     "clinic_info":          { "view": true, "update": false },
     "services":             { "view": true, "create": false, "update": false, "delete": false },
     "inventory":            { "view": false, "create": false, "update": false, "delete": false },