feat(secretary): add services permission resource + panel gating (phase A)

Secretaries could reach neither the services module (EntityContextResolver
does not recognise a secretary as clinic owner, so they resolved to
`unknown` → 403) nor had any toggle to grant it. Add `services` as a
first-class secretary permission resource, enforced end-to-end.

Backend
- DoctorSecretary::DEFAULT_PERMISSIONS: new `services` resource (default-deny).
- SecretaryAccessChecker::resolveOwnerEntity(): reusable owner (clinic/doctor)
  resolution from the secretary's active context, for controllers whose data
  is fetched by [entityType, entityId] and whose generic resolver is not
  secretary-aware.
- ClinicServiceController: resolveEntity() is now secretary-aware; every action
  (sections, items, tariffs — 13 total) guards with `services` view/create/
  update/delete via denyUnlessGranted, ahead of the subscription gate.

Frontend
- SecretaryPermissions type + MySecretariesPage + SecretariesPage: `services`
  section so owners can grant it.
- Sidebar (secretary branch): services / inventory / tags menu items gated by
  can(resource, 'view').
- RoleRoute: a secretary now needs the page's `permission` to open it (direct
  URL entry included); clinic-services, inventory, tags-settings routes accept
  secretary + permission gate.

Tests
- SecretaryResourceEnforcementTest: services denied-by-default, allowed-when-
  granted, create-denied-while-view-granted.
- Sidebar.test: secretary menu gating for services/inventory/tags.

Docs: secretary.md + clinic-services.md updated with the `services` resource
and the resolveOwnerEntity note.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/components/layout/Sidebar.test.tsx

@@ -76,3 +76,44 @@ describe("Sidebar — خدمات در منوی اصلی (نه تنظیمات)",
         );
     });
 });
+
+describe("Sidebar — گِیت منوی منشی بر اساس مجوز", () => {
+    const setSecretary = (resources: Record<string, Record<string, boolean>>) =>
+        useAuthStore.setState({
+            primaryRole: "secretary",
+            dbUuid: "c1",
+            userName: "منشی",
+            availableContexts: [],
+            context: { scope: "clinic", permissions: { resources } },
+        } as any);
+
+    it("منشیِ بدون مجوز، سرویس‌ها/انبار/تگ‌ها را نمی‌بیند", () => {
+        setSecretary({ appointments: { view: true } });
+        renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
+        expect(screen.queryByText("سرویس ها")).not.toBeInTheDocument();
+        expect(screen.queryByText("انبارداری")).not.toBeInTheDocument();
+        expect(screen.queryByText("تگ‌ها")).not.toBeInTheDocument();
+    });
+
+    it("با مجوز services.view، آیتم «سرویس ها» به /admin/clinic-services می‌رود", () => {
+        setSecretary({ services: { view: true } });
+        renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
+        expect(screen.getByText("سرویس ها").closest("a")).toHaveAttribute(
+            "href",
+            "/admin/clinic-services",
+        );
+    });
+
+    it("با مجوز inventory.view و tags.view، همان آیتم‌ها نمایش داده می‌شوند", () => {
+        setSecretary({ inventory: { view: true }, tags: { view: true } });
+        renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
+        expect(screen.getByText("انبارداری").closest("a")).toHaveAttribute(
+            "href",
+            "/admin/inventory",
+        );
+        expect(screen.getByText("تگ‌ها").closest("a")).toHaveAttribute(
+            "href",
+            "/admin/tags-settings",
+        );
+    });
+});

assets/admin/components/layout/Sidebar.tsx

@@ -401,6 +401,27 @@ function buildSections(
                 },
             );
         }
+        if (can("services", "view")) {
+            items.push({
+                to: "/admin/clinic-services",
+                icon: WrenchScrewdriverIcon,
+                label: "سرویس ها",
+            });
+        }
+        if (can("inventory", "view")) {
+            items.push({
+                to: "/admin/inventory",
+                icon: ArchiveBoxIcon,
+                label: "انبارداری",
+            });
+        }
+        if (can("tags", "view")) {
+            items.push({
+                to: "/admin/tags-settings",
+                icon: TagIcon,
+                label: "تگ‌ها",
+            });
+        }
 
         return [
             {