feat: add staff role functionality with dashboard access and service management

- Implemented SidebarStaff component tests to ensure staff users see only their dashboard and services.
- Created StaffMyServicesPage to display assigned services for staff users.
- Added migration to link clinic staff rows to user accounts for ROLE_STAFF access.
- Defined StaffPermissions class for static permissions related to staff role.
- Introduced StaffRouteGuardSubscriber to restrict API access for staff users.
- Developed StaffAccountService for managing staff user accounts and linking them to clinic staff.
- Added comprehensive tests for StaffAccountService to validate user creation, mobile number handling, and account attachment.
- Implemented tests for staff dashboard access to ensure proper permissions and access control.
- Created tests for staff login context to verify correct environment visibility based on user roles.

assets/admin/components/layout/Sidebar.tsx

@@ -490,6 +490,27 @@ function buildSections(
         ];
     }
 
+    if (primaryRole === "staff") {
+        // پرسنل فقط داشبورد خودش و سرویس‌های تخصیص‌یافته را دارد؛ بقیهٔ مسیرها
+        // سمت API هم برایش بسته است (StaffRouteGuardSubscriber).
+        return [
+            {
+                label: "عمومی",
+                items: [{ to: "/admin/dashboard", icon: ChartBarIcon, label: "داشبورد" }],
+            },
+            {
+                label: "مدیریت",
+                items: [
+                    {
+                        to: "/admin/my-services",
+                        icon: WrenchScrewdriverIcon,
+                        label: "سرویس‌های من",
+                    },
+                ],
+            },
+        ];
+    }
+
     if (primaryRole === "representation") {
         return [
             {
@@ -570,6 +591,7 @@ const ROLE_LABELS: Record<string, string> = {
     clinic: "مالک کلینیک",
     doctor: "پزشک",
     secretary: "منشی",
+    staff: "پرسنل",
     representation: "نماینده",
     user: "کاربر",
 };

assets/admin/components/layout/SidebarStaff.test.tsx

@@ -0,0 +1,50 @@
+import { screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+import { renderWithProviders } from "../../test/utils";
+
+vi.mock("../../hooks/useSubscription", () => ({
+    useSubscription: () => ({ hasFeature: () => true }),
+}));
+
+import { useAuthStore } from "../../stores/authStore";
+import Sidebar from "./Sidebar";
+
+/**
+ * پرسنل فقط داشبورد و سرویس‌های خودش را دارد؛ هیچ آیتم مدیریتی نباید در منویش
+ * ظاهر شود — قرینهٔ enforcement سمت API (StaffRouteGuardSubscriber).
+ */
+describe("Sidebar — نقش پرسنل", () => {
+    const asStaff = () =>
+        useAuthStore.setState({
+            primaryRole: "staff",
+            dbUuid: "d1",
+            userName: "زهرا احمدی",
+            availableContexts: [],
+            context: {
+                type: "doctor",
+                db_uuid: "d1",
+                name: "مطب تست",
+                role: "staff",
+                scope: "doctor",
+                permissions: { version: 1, resources: { services: { view: true }, appointments: { view: true } } },
+            },
+        } as any);
+
+    it("shows only داشبورد and سرویس‌های من", () => {
+        asStaff();
+        renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
+
+        expect(screen.getByText("داشبورد").closest("a")).toHaveAttribute("href", "/admin/dashboard");
+        expect(screen.getByText("سرویس‌های من").closest("a")).toHaveAttribute("href", "/admin/my-services");
+        expect(screen.getByText("پرسنل")).toBeInTheDocument(); // برچسب نقش در فوتر
+    });
+
+    it("hides management entries", () => {
+        asStaff();
+        renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
+
+        for (const label of ["پرونده بیماران", "تنظیمات", "نوبت‌ها", "پرداخت‌ها"]) {
+            expect(screen.queryByText(label)).not.toBeInTheDocument();
+        }
+    });
+});