fix(secretary): settings menu structure, clinic timeline access, patient delete gate

Three reported secretary-access bugs.

1) Settings menu structure. Phase B flat-listed staff/discounts/sms/tags/
   appointment_settings/clinic_doctors in the secretary's main sidebar. Mirror
   the doctor/clinic layout instead: only inventory + services stay in the main
   «مدیریت» nav; the rest live under a single «تنظیمات» entry
   (→ /admin/account-settings). Made both settings navs permission-aware for
   secretaries: SETTINGS_MENU (menuForRole now takes `can`) and
   PurchaseSubscriptionSidebar filter by a per-item `perm`/`alwaysOpen` instead
   of role only, so a secretary sees exactly their permitted settings pages and
   owner-only items (subscription, secretary-management) stay hidden.

2) Clinic secretary appointment timeline. AppointmentsPage treated a
   clinic-scoped secretary as a single-doctor profile: the doctor list was
   fetched/shown only for isClinic/isAdmin, so no doctor tabs, timeline, or
   booking. Now a clinic-scoped secretary is multi-doctor: fetches the doctor
   list, shows tabs, auto-selects the first doctor. The list comes from a new
   authenticated endpoint GET /api/v1/my/clinic-doctors returning only the
   secretary's ASSIGNED doctors — /clinic/doctor-list is on the public (no-JWT)
   firewall and cannot scope by user, so it would have leaked unbookable doctors.

3) Patient record delete. The `patients.delete` toggle was dead: every record
   delete (note/medical-record/attachment/call/message) was gated as
   `patients.update`. Mapped them to `patients.delete` so the toggle is honored
   and delete is controllable separately from edit.

New SecretaryAccessChecker::assignedClinicDoctorIds. Tests: doctor-list scoping,
patients.delete separation (denied/allowed). docs/api secretary.md +
appointment.md updated. Backend 286 + frontend 25 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/api/appointment.md

@@ -1045,3 +1045,26 @@ sessions exist, otherwise one of:
 Clients must not translate an empty `sessions` array into "closed". The admin panel used to do
 exactly that and reported «این روز تعطیل است» for a doctor whose clinic schedule was perfectly
 active — the request simply carried no `clinic_uuid`.
+
+---
+
+## GET /api/v1/my/clinic-doctors
+
+**Permission:** `IS_AUTHENTICATED_FULLY`
+
+پزشکانِ در دسترسِ کاربرِ پنل، برای ساختِ تب‌ها/تایم‌لاینِ صفحهٔ نوبت‌ها. برخلاف
+`GET /api/v1/clinic/doctor-list/{clinicUuid}` که روی firewallِ عمومی است و **همهٔ** پزشکانِ
+کلینیک را برمی‌گرداند، این اندپوینت احرازشده است و نتیجه را بر اساس نقش محدود می‌کند:
+
+- **منشیِ محیطِ کلینیک** → فقط پزشکانِ **تخصیص‌یافته** به همان منشی (`DoctorSecretary` فعال).
+- **منشیِ محیطِ مطب** → همان یک پزشک.
+- **کلینیک** → همهٔ پزشکانِ کلینیک · **پزشک** → خودش.
+
+بدونِ این، منشیِ کلینیک پزشکی را در تب می‌دید که برایش مجوزِ نوبت نداشت و روی
+slot/booking، `403` می‌گرفت.
+
+**Response `200`:**
+
+```json
+{ "success": true, "data": { "data": [ { "uuid": "…", "name": "دکتر …" } ] } }
+```