fix(secretary): allow insurance pages; add grantable subscription resource

Insurance pages redirected to the dashboard: the insurance-pricing/claims
routes never listed `secretary`, so RoleRoute bounced a secretary who had
insurances.view and saw the menu item. Added secretary + permission
['insurances','view'] to both routes; also gated my-financial with
['payments','view'] for consistency.

«خرید اشتراک» was owner-only with no permission toggle, so it could not be
granted. Added a `subscription` secretary resource (view/create) end-to-end:
- entity DEFAULT_PERMISSIONS + SecretaryPermissions type + both secretary forms.
- backend: SubscriptionController::my (view) and trial (create),
  PaymentController::initiateSubscription (create). resolveEntity in
  SubscriptionController was already secretary-aware.
- frontend: subscription + subscription/success routes accept secretary +
  permission; settings navs gate «خرید اشتراک» by ['subscription','view'].

Tests: subscription denied-by-default / allowed-when-granted. docs/api
secretary.md updated (resource list, enforcement map, JSON example).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/pages/MySecretariesPage.tsx

@@ -81,6 +81,7 @@ const EMPTY_PERMISSIONS: SecretaryPermissions = {
     sms: { view: false, create: false, update: false, delete: false },
     appointment_settings: { view: false, update: false },
     clinic_doctors: { view: false, create: false, update: false, delete: false },
+    subscription: { view: false, create: false },
 };
 
 type PermSection = keyof SecretaryPermissions;
@@ -229,6 +230,14 @@ const PERMISSION_SECTIONS: {
             { key: "delete", label: "حذف پزشک" },
         ],
     },
+    {
+        key: "subscription",
+        title: "خرید اشتراک",
+        items: [
+            { key: "view", label: "مشاهده اشتراک" },
+            { key: "create", label: "خرید/فعال‌سازی اشتراک" },
+        ],
+    },
 ];
 
 function PermissionAccordions({

assets/admin/pages/SecretariesPage.tsx

@@ -27,6 +27,7 @@ const DEFAULT_PERMISSIONS: SecretaryPermissions = {
   sms: { view: false, create: false, update: false, delete: false },
   appointment_settings: { view: false, update: false },
   clinic_doctors: { view: false, create: false, update: false, delete: false },
+  subscription: { view: false, create: false },
 };
 
 type PermSection = keyof SecretaryPermissions;
@@ -154,6 +155,13 @@ const PERMISSION_LABELS: Record<PermSection, { label: string; actions: { key: st
       { key: 'delete', label: 'حذف' },
     ],
   },
+  subscription: {
+    label: 'خرید اشتراک',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'خرید' },
+    ],
+  },
 };
 
 function PermissionsMatrix({