feat: Implement secretary permissions enforcement across multiple resources

- Added SecretaryAccessChecker to manage resource access for secretaries.
- Integrated permission checks for payments, inventory, and tags in relevant controllers.
- Updated PaymentController and PaymentMethodController to enforce secretary permissions.
- Enhanced TenantTagController to check permissions for tag management actions.
- Introduced tests for secretary resource enforcement, ensuring proper access control.
- Updated DoctorSecretary entity to include inventory and tags permissions.
- Created a comprehensive audit document for secretary permissions coverage and enforcement.
- Fixed potential crashes in SecretaryDashboard when rendering without doctor data.

docs/api/dashboard.md

@@ -196,41 +196,43 @@ Returns stats for the authenticated secretary and (conditionally) today's appoin
 
 ### Response `200`
 
+پاسخ بر اساس `scope` محیطِ فعالِ منشی دو شکل دارد. **کلید `scope` تمایزدهنده است**: در `scope=doctor` فیلد `doctor` هست (نه `clinic`) و در `scope=clinic` فیلد `clinic` (نه `doctor`). کلاینت باید هر دو را مدیریت کند و به‌صورت مستقیم به `data.doctor.name` دسترسی نگیرد.
+
+**منشیِ مطبِ شخصی (`scope=doctor`):**
+
 ```json
 {
   "success": true,
   "data": {
-    "doctor": {
-      "uuid": "string",
-      "name": "string",
-      "degree": "string | null"
-    },
-    "permissions": {
-      "resources": {
-        "appointments": {
-          "view": true,
-          "edit": false
-        }
-      }
-    },
-    "stats": {
-      "today_appointments": 8,
-      "tomorrow_appointments": 5
-    },
+    "scope": "doctor",
+    "doctor": { "uuid": "string", "name": "string", "degree": "string | null" },
+    "permissions": { "resources": { "appointments": { "view": true, "update_status": false } } },
+    "stats": { "today_appointments": 8, "tomorrow_appointments": 5 },
     "today_appointments": [
-      {
-        "uuid": "string",
-        "patient_name": "string | null",
-        "patient_mobile": "string",
-        "slot_start": 1700000000,
-        "status": "reserved"
-      }
+      { "uuid": "string", "patient_name": "string | null", "patient_mobile": "string", "slot_start": 1700000000, "status": "reserved" }
     ]
   }
 }
 ```
 
-`today_appointments` — only populated when `permissions.resources.appointments.view === true`; up to 10 records when visible.
+**منشیِ کلینیک (`scope=clinic`) — بدون کلید `doctor`:**
+
+```json
+{
+  "success": true,
+  "data": {
+    "scope": "clinic",
+    "clinic": { "uuid": "string", "name": "string" },
+    "permissions": { "resources": { "appointments": { "view": true } } },
+    "stats": { "today_appointments": 12, "tomorrow_appointments": 7 },
+    "today_appointments": [
+      { "uuid": "string", "patient_name": "string | null", "patient_mobile": "string", "slot_start": 1700000000, "status": "reserved", "doctor_name": "string" }
+    ]
+  }
+}
+```
+
+`today_appointments` — only populated when `permissions.resources.appointments.view === true`; up to 10 records (doctor scope) / 20 (clinic scope) when visible. در scope کلینیک هر ردیف `doctor_name` هم دارد.
 
 ### Errors