feat(permissions): expose the registry over GET /api/v1/permission-catalog

Both permission forms in the admin panel can now render from the backend
registry instead of their own hardcoded lists. Resources come back as an array
so display order is part of the contract, each carrying its Persian label, its
actions, and the clinic_only flag that used to live in the frontend.

contextPermissions() normalizes the no-row branch through the registry too, so
a doctor whose permission row was never provisioned sees the same shape as one
who has it.

Two existing assertions compared the API response against DEFAULT_PERMISSIONS
by identity. The values are unchanged; only key order moved to the registry's,
so both now compare through PermissionCatalog::merge.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/Auth/Controller/AuthController.php

@@ -16,6 +16,7 @@ use App\Secretary\Repository\DoctorSecretaryRepository;
 use App\Shared\Captcha\CaptchaGuard;
 use App\Shared\Constant\ErrorCodes;
 use App\Shared\Controller\BaseController;
+use App\Shared\Security\PermissionCatalog;
 use App\Staff\Repository\ClinicStaffRepository;
 use App\Staff\Security\StaffPermissions;
 use Doctrine\ORM\EntityManagerInterface;
@@ -816,7 +817,7 @@ class AuthController extends BaseController
     private function contextPermissions(?ClinicDoctorPermission $perm): array
     {
         if ($perm === null) {
-            return ClinicDoctorPermission::DEFAULT_PERMISSIONS;
+            return PermissionCatalog::merge([], ClinicDoctorPermission::DEFAULT_PERMISSIONS);
         }
 
         return $perm->isActive()

src/Shared/Controller/PermissionCatalogController.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Shared\Controller;
+
+use App\Shared\Security\PermissionCatalog;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+
+/**
+ * فهرستِ منابع قابل‌مجوزدهی برای فرم‌های مجوزِ پنل.
+ *
+ * پاسخ به کاربر بستگی ندارد — همان رجیستری است — پس کلاینت می‌تواند بلندمدت
+ * cache کند. مقدارِ واقعیِ مجوزِ هر رابطه از اندپوینت‌های خودِ منشی/پزشک می‌آید.
+ */
+#[Route('/api/v1')]
+#[IsGranted('IS_AUTHENTICATED_FULLY')]
+class PermissionCatalogController extends BaseController
+{
+    #[Route('/permission-catalog', name: 'api_permission_catalog', methods: ['GET'])]
+    public function index(): JsonResponse
+    {
+        return $this->success([
+            'version'   => PermissionCatalog::VERSION,
+            'resources' => PermissionCatalog::toApiArray(),
+        ]);
+    }
+}