fix(secretary): settings menu structure, clinic timeline access, patient delete gate

Three reported secretary-access bugs.

1) Settings menu structure. Phase B flat-listed staff/discounts/sms/tags/
   appointment_settings/clinic_doctors in the secretary's main sidebar. Mirror
   the doctor/clinic layout instead: only inventory + services stay in the main
   «مدیریت» nav; the rest live under a single «تنظیمات» entry
   (→ /admin/account-settings). Made both settings navs permission-aware for
   secretaries: SETTINGS_MENU (menuForRole now takes `can`) and
   PurchaseSubscriptionSidebar filter by a per-item `perm`/`alwaysOpen` instead
   of role only, so a secretary sees exactly their permitted settings pages and
   owner-only items (subscription, secretary-management) stay hidden.

2) Clinic secretary appointment timeline. AppointmentsPage treated a
   clinic-scoped secretary as a single-doctor profile: the doctor list was
   fetched/shown only for isClinic/isAdmin, so no doctor tabs, timeline, or
   booking. Now a clinic-scoped secretary is multi-doctor: fetches the doctor
   list, shows tabs, auto-selects the first doctor. The list comes from a new
   authenticated endpoint GET /api/v1/my/clinic-doctors returning only the
   secretary's ASSIGNED doctors — /clinic/doctor-list is on the public (no-JWT)
   firewall and cannot scope by user, so it would have leaked unbookable doctors.

3) Patient record delete. The `patients.delete` toggle was dead: every record
   delete (note/medical-record/attachment/call/message) was gated as
   `patients.update`. Mapped them to `patients.delete` so the toggle is honored
   and delete is controllable separately from edit.

New SecretaryAccessChecker::assignedClinicDoctorIds. Tests: doctor-list scoping,
patients.delete separation (denied/allowed). docs/api secretary.md +
appointment.md updated. Backend 286 + frontend 25 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/components/layout/PurchaseSubscriptionSidebar.test.tsx

@@ -1,6 +1,7 @@
 import { describe, it, expect } from 'vitest';
 import { screen } from '@testing-library/react';
 import { renderWithProviders } from '../../test/utils';
+import { useAuthStore } from '../../stores/authStore';
 import PurchaseSubscriptionSidebar from './PurchaseSubscriptionSidebar';
 
 describe('PurchaseSubscriptionSidebar — settings menu', () => {
@@ -20,6 +21,23 @@ describe('PurchaseSubscriptionSidebar — settings menu', () => {
     expect(screen.getByRole('link', { name: 'مدیریت منشی' })).not.toHaveAttribute('aria-current');
   });
 
+  it('برای منشی فقط آیتم‌های مجاز را نشان می‌دهد (staff مجاز، بقیه پنهان)', () => {
+    useAuthStore.setState({
+      primaryRole: 'secretary',
+      context: { scope: 'clinic', permissions: { resources: { staff: { view: true } } } },
+    } as any);
+    renderWithProviders(<PurchaseSubscriptionSidebar active="staff" />, { route: '/admin/staff' });
+
+    // مجاز
+    expect(screen.getByRole('link', { name: 'پرسنل' })).toHaveAttribute('href', '/admin/staff');
+    expect(screen.getByRole('link', { name: 'حساب کاربری' })).toBeInTheDocument();
+    // owner-only / بدون مجوز → پنهان
+    expect(screen.queryByRole('link', { name: 'مدیریت منشی' })).not.toBeInTheDocument();
+    expect(screen.queryByRole('link', { name: 'خرید اشتراک' })).not.toBeInTheDocument();
+    expect(screen.queryByRole('link', { name: 'مدیریت تخفیف‌ها' })).not.toBeInTheDocument();
+    useAuthStore.setState({ primaryRole: null, context: null } as any);
+  });
+
   // regression: the settings menu must stay visible on mobile (was `hidden lg:block`,
   // which dropped the whole menu below the lg breakpoint → no settings nav on phones).
   it('is not hidden on mobile', () => {