feat: Implement secretary permissions enforcement across multiple resources

- Added SecretaryAccessChecker to manage resource access for secretaries.
- Integrated permission checks for payments, inventory, and tags in relevant controllers.
- Updated PaymentController and PaymentMethodController to enforce secretary permissions.
- Enhanced TenantTagController to check permissions for tag management actions.
- Introduced tests for secretary resource enforcement, ensuring proper access control.
- Updated DoctorSecretary entity to include inventory and tags permissions.
- Created a comprehensive audit document for secretary permissions coverage and enforcement.
- Fixed potential crashes in SecretaryDashboard when rendering without doctor data.

docs/api/inventory.md

@@ -2,6 +2,8 @@
 
 > **Prefix:** `/api/v1/inventory-*`
 
+> **دسترسی منشی:** برای `ROLE_SECRETARY` روی منبع `inventory` اعمال می‌شود (`SecretaryAccessChecker`): GET→`view`, POST→`create`, PATCH→`update`, DELETE→`delete`؛ نبودِ مجوز → `403`. پیش‌فرضِ منشی برای این منبع همه `false` است. جزئیات: [secretary.md](secretary.md).
+
 Per-tenant (doctor/clinic) consumable-stock management: **items** and **packages**
 (bundles of items). Every row is scoped to the caller's resolved entity
 (`doctor` / `clinic`), exactly like Tenant Tags — a tenant only ever sees and