feat: Implement secretary permissions enforcement across multiple resources

- Added SecretaryAccessChecker to manage resource access for secretaries.
- Integrated permission checks for payments, inventory, and tags in relevant controllers.
- Updated PaymentController and PaymentMethodController to enforce secretary permissions.
- Enhanced TenantTagController to check permissions for tag management actions.
- Introduced tests for secretary resource enforcement, ensuring proper access control.
- Updated DoctorSecretary entity to include inventory and tags permissions.
- Created a comprehensive audit document for secretary permissions coverage and enforcement.
- Fixed potential crashes in SecretaryDashboard when rendering without doctor data.

src/Payment/Controller/PaymentController.php

@@ -10,6 +10,7 @@ use App\Config\Repository\SiteConfigRepository;
 use App\Payment\Gateway\GatewayFactory;
 use App\Payment\Repository\PaymentRepository;
 use App\Payment\Service\PaymentManager;
+use App\Secretary\Security\SecretaryAccessChecker;
 use App\Shared\Constant\ErrorCodes;
 use App\Shared\Controller\BaseController;
 use OpenApi\Attributes as OA;
@@ -35,6 +36,7 @@ class PaymentController extends BaseController
         private readonly GatewayFactory        $gateways,
         private readonly PaymentManager        $paymentManager,
         private readonly SiteConfigRepository  $configRepo,
+        private readonly SecretaryAccessChecker $secretaryAccess,
         private readonly string                $appBaseUrl,
         private readonly string                $allowedFrontendHosts = '',
     ) {}
@@ -505,6 +507,7 @@ class PaymentController extends BaseController
     #[Route('/api/v1/my/payments', methods: ['GET'])]
     public function myPayments(Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'payments', 'view');
         $page   = max(1, (int) $request->query->get('page', 1));
         $limit  = min(100, max(1, (int) $request->query->get('limit', 20)));
         $status = $request->query->get('status');