fix(secretary): settings menu structure, clinic timeline access, patient delete gate

Three reported secretary-access bugs.

1) Settings menu structure. Phase B flat-listed staff/discounts/sms/tags/
   appointment_settings/clinic_doctors in the secretary's main sidebar. Mirror
   the doctor/clinic layout instead: only inventory + services stay in the main
   «مدیریت» nav; the rest live under a single «تنظیمات» entry
   (→ /admin/account-settings). Made both settings navs permission-aware for
   secretaries: SETTINGS_MENU (menuForRole now takes `can`) and
   PurchaseSubscriptionSidebar filter by a per-item `perm`/`alwaysOpen` instead
   of role only, so a secretary sees exactly their permitted settings pages and
   owner-only items (subscription, secretary-management) stay hidden.

2) Clinic secretary appointment timeline. AppointmentsPage treated a
   clinic-scoped secretary as a single-doctor profile: the doctor list was
   fetched/shown only for isClinic/isAdmin, so no doctor tabs, timeline, or
   booking. Now a clinic-scoped secretary is multi-doctor: fetches the doctor
   list, shows tabs, auto-selects the first doctor. The list comes from a new
   authenticated endpoint GET /api/v1/my/clinic-doctors returning only the
   secretary's ASSIGNED doctors — /clinic/doctor-list is on the public (no-JWT)
   firewall and cannot scope by user, so it would have leaked unbookable doctors.

3) Patient record delete. The `patients.delete` toggle was dead: every record
   delete (note/medical-record/attachment/call/message) was gated as
   `patients.update`. Mapped them to `patients.delete` so the toggle is honored
   and delete is controllable separately from edit.

New SecretaryAccessChecker::assignedClinicDoctorIds. Tests: doctor-list scoping,
patients.delete separation (denied/allowed). docs/api secretary.md +
appointment.md updated. Backend 286 + frontend 25 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/Appointment/Controller/MyAppointmentsController.php

@@ -47,6 +47,43 @@ class MyAppointmentsController extends BaseController
         private readonly VisitPriceRequirementResolver $visitPriceResolver,
     ) {}
 
+    /**
+     * پزشکانِ در دسترسِ کاربرِ پنل — برای تب‌ها/تایم‌لاینِ نوبت‌ها. برخلاف
+     * /clinic/doctor-list (که عمومی است و همهٔ پزشکانِ کلینیک را می‌دهد)، این
+     * اندپوینت احرازشده است: منشی فقط پزشکانِ تخصیص‌یافتهٔ خودش را می‌گیرد، پس تب‌ها
+     * دقیقاً با مجوزِ نوبت‌دهی‌اش هم‌راستا می‌شوند.
+     */
+    #[Route('/api/v1/my/clinic-doctors', methods: ['GET'])]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
+    public function myClinicDoctors(#[CurrentUser] User $user): JsonResponse
+    {
+        $roles   = $user->getRoles();
+        $doctors = [];
+
+        if (in_array('ROLE_SECRETARY', $roles, true)) {
+            $filter = $this->resolveSecretaryFilter($user);
+            if ($filter !== null) {
+                [$type, $value] = $filter;
+                $doctors = $type === 'clinic'
+                    ? ($value === [] ? [] : $this->doctorRepo->findBy(['id' => $value]))
+                    : [$value];
+            }
+        } elseif (in_array('ROLE_CLINIC', $roles, true)) {
+            $clinic  = $this->clinicRepo->findByUser($user);
+            $doctors = $clinic !== null ? $clinic->getDoctors()->toArray() : [];
+        } elseif (in_array('ROLE_DOCTOR', $roles, true)) {
+            $doctor  = $this->doctorRepo->findByUser($user);
+            $doctors = $doctor !== null ? [$doctor] : [];
+        }
+
+        $data = array_map(
+            static fn(Doctor $d) => ['uuid' => $d->getUuid(), 'name' => $d->getName()],
+            $doctors,
+        );
+
+        return $this->success(['data' => $data]);
+    }
+
     #[Route('/api/v1/my/appointment', methods: ['POST'])]
     #[IsGranted('IS_AUTHENTICATED_FULLY')]
     public function createAppointment(Request $request, #[CurrentUser] User $user): JsonResponse

src/Clinic/Controller/ClinicController.php

@@ -333,6 +333,9 @@ class ClinicController extends BaseController
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'کلینیک یافت نشد', 404);
         }
 
+        // این اندپوینت روی firewallِ عمومی است (سایت هم بی‌توکن مصرفش می‌کند) → اینجا
+        // کاربر احراز نمی‌شود. محدودسازیِ منشی به پزشکانِ تخصیص‌یافته در اندپوینتِ
+        // احرازشدهٔ پنل انجام می‌شود: GET /api/v1/my/clinic-doctors.
         $result        = $this->doctorRepo->findByClinicWithFilters((int) $clinic->getId(), $request->query->all());
         $clinicDoctors = $result['items'];
 

src/Patient/Controller/PatientController.php

@@ -276,7 +276,7 @@ class PatientController extends BaseController
     #[Route('/api/v1/patient/call/{uuid}', methods: ['DELETE'])]
     public function deleteCall(string $uuid, #[CurrentUser] User $user): JsonResponse
     {
-        $this->secretaryAccess->denyUnlessGranted($user, 'patients', 'update');
+        $this->secretaryAccess->denyUnlessGranted($user, 'patients', 'delete');
         [$entityType, $entityId] = $this->resolveEntity($user);
         $call = $this->callRepo->findByUuid($uuid);
         if ($call === null || !$this->ownsRecord($call->getRecord(), $entityType, $entityId, $user)) {
@@ -334,7 +334,7 @@ class PatientController extends BaseController
     #[Route('/api/v1/patient/message/{uuid}', methods: ['DELETE'])]
     public function deleteMessage(string $uuid, #[CurrentUser] User $user): JsonResponse
     {
-        $this->secretaryAccess->denyUnlessGranted($user, 'patients', 'update');
+        $this->secretaryAccess->denyUnlessGranted($user, 'patients', 'delete');
         [$entityType, $entityId] = $this->resolveEntity($user);
         $message = $this->messageRepo->findByUuid($uuid);
         if ($message === null || !$this->ownsRecord($message->getRecord(), $entityType, $entityId, $user)) {
@@ -418,7 +418,7 @@ class PatientController extends BaseController
     #[Route('/api/v1/patient/note/{uuid}', methods: ['DELETE'])]
     public function deleteNote(string $uuid, #[CurrentUser] User $user): JsonResponse
     {
-        $this->secretaryAccess->denyUnlessGranted($user, 'patients', 'update');
+        $this->secretaryAccess->denyUnlessGranted($user, 'patients', 'delete');
         [$entityType, $entityId] = $this->resolveEntity($user);
         $note = $this->noteRepo->findByUuid($uuid);
         if ($note === null || !$this->ownsRecord($note->getRecord(), $entityType, $entityId, $user)) {
@@ -506,7 +506,7 @@ class PatientController extends BaseController
     #[Route('/api/v1/patient/medical-record/{uuid}', methods: ['DELETE'])]
     public function deleteMedicalRecord(string $uuid, #[CurrentUser] User $user): JsonResponse
     {
-        $this->secretaryAccess->denyUnlessGranted($user, 'patients', 'update');
+        $this->secretaryAccess->denyUnlessGranted($user, 'patients', 'delete');
         [$entityType, $entityId] = $this->resolveEntity($user);
         $medical = $this->medicalRepo->findByUuid($uuid);
         if ($medical === null || !$this->ownsRecord($medical->getRecord(), $entityType, $entityId, $user)) {
@@ -561,7 +561,7 @@ class PatientController extends BaseController
     #[Route('/api/v1/patient/attachment/{uuid}', methods: ['DELETE'])]
     public function deleteAttachment(string $uuid, #[CurrentUser] User $user): JsonResponse
     {
-        $this->secretaryAccess->denyUnlessGranted($user, 'patients', 'update');
+        $this->secretaryAccess->denyUnlessGranted($user, 'patients', 'delete');
         [$entityType, $entityId] = $this->resolveEntity($user);
         $attachment = $this->attachmentRepo->findByUuid($uuid);
         if ($attachment === null || !$this->ownsRecord($attachment->getRecord(), $entityType, $entityId, $user)) {

src/Secretary/Security/SecretaryAccessChecker.php

@@ -126,6 +126,25 @@ class SecretaryAccessChecker
         return $relation !== null && $this->permissions->can($relation, $resource, $action);
     }
 
+    /**
+     * idهای پزشکانِ تخصیص‌یافته به این منشی در این کلینیک — برای محدودکردنِ
+     * لیست‌هایی که پیش‌فرض همهٔ پزشکانِ کلینیک را برمی‌گردانند. اگر منشی نیست یا
+     * محیطش این کلینیک نیست → آرایهٔ خالی.
+     *
+     * @return int[]
+     */
+    public function assignedClinicDoctorIds(User $user, \App\Clinic\Entity\Clinic $clinic): array
+    {
+        if (!$user->hasRole('ROLE_SECRETARY')) {
+            return [];
+        }
+
+        return array_map(
+            static fn(\App\Doctor\Entity\Doctor $d) => $d->getId(),
+            $this->secretaryRepo->findDoctorsBySecretaryInClinic($user, $clinic),
+        );
+    }
+
     /**
      * آیا منشی در محیطِ فعالِ خود — که باید همین کلینیک باشد — مجاز به resource/action است؟
      * برای منابعِ کلینیک‌سطح مثل clinic_doctors که tenant لزوماً کلینیک است.