feat: Implement secretary permissions enforcement across multiple resources

- Added SecretaryAccessChecker to manage resource access for secretaries.
- Integrated permission checks for payments, inventory, and tags in relevant controllers.
- Updated PaymentController and PaymentMethodController to enforce secretary permissions.
- Enhanced TenantTagController to check permissions for tag management actions.
- Introduced tests for secretary resource enforcement, ensuring proper access control.
- Updated DoctorSecretary entity to include inventory and tags permissions.
- Created a comprehensive audit document for secretary permissions coverage and enforcement.
- Fixed potential crashes in SecretaryDashboard when rendering without doctor data.

tests/PaymentMethod/PaymentMethodTest.php

@@ -162,7 +162,8 @@ class PaymentMethodTest extends ApiTestCase
 
     public function testTogglePosStatus(): void
     {
-        $user = $this->createUser(['ROLE_SECRETARY']);
+        // منشی به روش‌های پرداخت فقط با مجوز payments از طریق رابطهٔ فعال دسترسی دارد.
+        $user = $this->createSecretaryWithPayments(['view' => true, 'create' => true, 'update' => true]);
         $created = $this->authJson('POST', '/api/v1/my/payment-methods/pos', $user, [
             'bank_name'       => 'تجارت',
             'terminal_number' => '345678',
@@ -175,6 +176,41 @@ class PaymentMethodTest extends ApiTestCase
         $this->assertFalse($toggled['data']['is_active']);
     }
 
+    public function testSecretaryWithoutPaymentsPermissionCannotManagePos(): void
+    {
+        $user = $this->createSecretaryWithPayments(['view' => false, 'create' => false, 'update' => false]);
+
+        $this->authJson('POST', '/api/v1/my/payment-methods/pos', $user, [
+            'bank_name'       => 'تجارت',
+            'terminal_number' => '345678',
+        ]);
+
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    /** منشی با رابطهٔ فعالِ کلینیک + context + مجوز payments مشخص. */
+    private function createSecretaryWithPayments(array $payments): \App\Auth\Entity\User
+    {
+        $owner  = $this->createUser(['ROLE_CLINIC']);
+        $clinic = new \App\Clinic\Entity\Clinic($owner);
+        $this->em->persist($clinic);
+
+        $doctor = new \App\Doctor\Entity\Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تست');
+        $this->em->persist($doctor);
+        $clinic->getDoctors()->add($doctor);
+
+        $secretary = $this->createUser(['ROLE_SECRETARY']);
+        $rel = new \App\Secretary\Entity\DoctorSecretary(
+            $doctor, $secretary, \App\Secretary\Entity\DoctorSecretary::OWNER_CLINIC, $clinic
+        );
+        $rel->mergePermissions(['resources' => ['payments' => $payments]]);
+        $this->em->persist($rel);
+        $this->em->persist(new \App\Auth\Entity\UserActiveContext($secretary, $clinic->getUuid()));
+        $this->em->flush();
+
+        return $secretary;
+    }
+
     public function testPosListIsolatedPerUser(): void
     {
         $a = $this->createUser(['ROLE_CLINIC']);