fix(secretary): settings menu structure, clinic timeline access, patient delete gate

Three reported secretary-access bugs.

1) Settings menu structure. Phase B flat-listed staff/discounts/sms/tags/
   appointment_settings/clinic_doctors in the secretary's main sidebar. Mirror
   the doctor/clinic layout instead: only inventory + services stay in the main
   «مدیریت» nav; the rest live under a single «تنظیمات» entry
   (→ /admin/account-settings). Made both settings navs permission-aware for
   secretaries: SETTINGS_MENU (menuForRole now takes `can`) and
   PurchaseSubscriptionSidebar filter by a per-item `perm`/`alwaysOpen` instead
   of role only, so a secretary sees exactly their permitted settings pages and
   owner-only items (subscription, secretary-management) stay hidden.

2) Clinic secretary appointment timeline. AppointmentsPage treated a
   clinic-scoped secretary as a single-doctor profile: the doctor list was
   fetched/shown only for isClinic/isAdmin, so no doctor tabs, timeline, or
   booking. Now a clinic-scoped secretary is multi-doctor: fetches the doctor
   list, shows tabs, auto-selects the first doctor. The list comes from a new
   authenticated endpoint GET /api/v1/my/clinic-doctors returning only the
   secretary's ASSIGNED doctors — /clinic/doctor-list is on the public (no-JWT)
   firewall and cannot scope by user, so it would have leaked unbookable doctors.

3) Patient record delete. The `patients.delete` toggle was dead: every record
   delete (note/medical-record/attachment/call/message) was gated as
   `patients.update`. Mapped them to `patients.delete` so the toggle is honored
   and delete is controllable separately from edit.

New SecretaryAccessChecker::assignedClinicDoctorIds. Tests: doctor-list scoping,
patients.delete separation (denied/allowed). docs/api secretary.md +
appointment.md updated. Backend 286 + frontend 25 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/pages/AppointmentsPage.tsx

@@ -489,10 +489,14 @@ export default function AppointmentsPage() {
   // در محیط کلینیک، dbUuid شناسهٔ کلینیک است نه پزشک؛ uuid پزشک فقط از doctorUuid می‌آید.
   const doctorUuid = useAuthStore(s => s.doctorUuid);
   const clinicUuid = useClinicContext();
+  const scope = useAuthStore(s => s.context?.scope);
   const isAdmin = primaryRole === 'admin';
   const isClinic = primaryRole === 'clinic';
   const isDoctor = primaryRole === 'doctor';
   const isRepresentation = primaryRole === 'representation';
+  // منشیِ محیطِ کلینیک باید مثل کلینیک چندپزشکه رفتار کند: تب پزشکان + تایم‌لاین.
+  // dbUuid در این محیط uuid کلینیک است (نه پزشک) — همان مبنای clinic/doctor-list.
+  const isClinicScopedSecretary = primaryRole === 'secretary' && scope === 'clinic';
 
   const [params] = useSearchParams();
   const today = new Date().toISOString().slice(0, 10);
@@ -542,9 +546,15 @@ export default function AppointmentsPage() {
 
   // ── Clinic doctors (authoritative list for tabs)
   const clinicDoctorsQuery = useQuery<ApiResponse<{ data: { uuid: string; name: string }[] }>>({
-    queryKey: ['clinic-doctors', dbUuid],
-    queryFn: () => api.get(`/api/v1/clinic/doctor-list/${dbUuid}`),
-    enabled: isClinic && !!dbUuid,
+    queryKey: ['clinic-doctors', dbUuid, isClinicScopedSecretary],
+    // منشی از اندپوینتِ احرازشده می‌گیرد تا فقط پزشکانِ تخصیص‌یافته‌اش بیایند؛
+    // کلینیک/ادمین از لیستِ کاملِ عمومیِ کلینیک.
+    queryFn: () => api.get(
+      isClinicScopedSecretary
+        ? '/api/v1/my/clinic-doctors'
+        : `/api/v1/clinic/doctor-list/${dbUuid}`,
+    ),
+    enabled: (isClinic || isClinicScopedSecretary) && !!dbUuid,
   });
   const clinicDoctorsList = clinicDoctorsQuery.data?.data?.data ?? [];
 
@@ -570,16 +580,16 @@ export default function AppointmentsPage() {
 
   // نوع پروفایل: کلینیک چندپزشکه (تب دکترها + مدیریت چند پزشک) در برابر پزشک مستقل.
   // نقش clinic/admin = چندپزشکه؛ نقش doctor (حتی مهمانِ کلینیک) = مستقل، فقط برنامهٔ خودش.
-  const isMultiDoctorClinic = isClinic || isAdmin;
+  const isMultiDoctorClinic = isClinic || isAdmin || isClinicScopedSecretary;
   const showDoctorTabs = isMultiDoctorClinic && doctors.length >= 1;
   const showDoctorCol = isAdmin && !selectedDoctorUuid;
 
   // در کلینیک، اولین دکتر به‌صورت پیش‌فرض انتخاب می‌شود تا زمانبندی مثل طرح پر باشد.
   useEffect(() => {
-    if (isClinic && !selectedDoctorUuid && doctors.length > 0) {
+    if ((isClinic || isClinicScopedSecretary) && !selectedDoctorUuid && doctors.length > 0) {
       setSelectedDoctorUuid(doctors[0].uuid);
     }
-  }, [isClinic, selectedDoctorUuid, doctors]);
+  }, [isClinic, isClinicScopedSecretary, selectedDoctorUuid, doctors]);
 
   // ── محل نوبت‌دهی برای ادمین
   // ادمین context کلینیکی ندارد (useClinicContext → null)؛ بدون clinic_uuid فقط برنامهٔ

assets/admin/pages/SettingsMenuPage.tsx

@@ -3,6 +3,7 @@ import { Link } from 'react-router-dom';
 import { ChevronLeftIcon } from '@heroicons/react/24/outline';
 import { menuForRole } from '../components/layout/SettingsLayout';
 import { useAuthStore } from '../stores/authStore';
+import { usePermissions } from '../hooks/usePermissions';
 
 /**
  * SettingsMenuPage — the settings landing list for doctor/clinic users.
@@ -12,7 +13,8 @@ import { useAuthStore } from '../stores/authStore';
  */
 export default function SettingsMenuPage() {
   const primaryRole = useAuthStore((s) => s.primaryRole);
-  const items = menuForRole(primaryRole);
+  const { can } = usePermissions();
+  const items = menuForRole(primaryRole, can);
 
   return (
     <div className="fade-in" style={{ maxWidth: 720, margin: '0 auto' }}>