feat(secretary): add services permission resource + panel gating (phase A)

Secretaries could reach neither the services module (EntityContextResolver
does not recognise a secretary as clinic owner, so they resolved to
`unknown` → 403) nor had any toggle to grant it. Add `services` as a
first-class secretary permission resource, enforced end-to-end.

Backend
- DoctorSecretary::DEFAULT_PERMISSIONS: new `services` resource (default-deny).
- SecretaryAccessChecker::resolveOwnerEntity(): reusable owner (clinic/doctor)
  resolution from the secretary's active context, for controllers whose data
  is fetched by [entityType, entityId] and whose generic resolver is not
  secretary-aware.
- ClinicServiceController: resolveEntity() is now secretary-aware; every action
  (sections, items, tariffs — 13 total) guards with `services` view/create/
  update/delete via denyUnlessGranted, ahead of the subscription gate.

Frontend
- SecretaryPermissions type + MySecretariesPage + SecretariesPage: `services`
  section so owners can grant it.
- Sidebar (secretary branch): services / inventory / tags menu items gated by
  can(resource, 'view').
- RoleRoute: a secretary now needs the page's `permission` to open it (direct
  URL entry included); clinic-services, inventory, tags-settings routes accept
  secretary + permission gate.

Tests
- SecretaryResourceEnforcementTest: services denied-by-default, allowed-when-
  granted, create-denied-while-view-granted.
- Sidebar.test: secretary menu gating for services/inventory/tags.

Docs: secretary.md + clinic-services.md updated with the `services` resource
and the resolveOwnerEntity note.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/pages/MySecretariesPage.tsx

@@ -75,6 +75,7 @@ const EMPTY_PERMISSIONS: SecretaryPermissions = {
     clinic_info: { view: false, update: false },
     inventory: { view: false, create: false, update: false, delete: false },
     tags: { view: false, create: false, update: false, delete: false },
+    services: { view: false, create: false, update: false, delete: false },
 };
 
 type PermSection = keyof SecretaryPermissions;
@@ -162,6 +163,16 @@ const PERMISSION_SECTIONS: {
             { key: "delete", label: "حذف تگ" },
         ],
     },
+    {
+        key: "services",
+        title: "خدمات و تعرفه‌ها",
+        items: [
+            { key: "view", label: "مشاهده خدمات" },
+            { key: "create", label: "ایجاد خدمت" },
+            { key: "update", label: "ویرایش خدمت" },
+            { key: "delete", label: "حذف خدمت" },
+        ],
+    },
 ];
 
 function PermissionAccordions({

assets/admin/pages/SecretariesPage.tsx

@@ -21,6 +21,7 @@ const DEFAULT_PERMISSIONS: SecretaryPermissions = {
   clinic_info: { view: true, update: false },
   inventory: { view: false, create: false, update: false, delete: false },
   tags: { view: false, create: false, update: false, delete: false },
+  services: { view: false, create: false, update: false, delete: false },
 };
 
 type PermSection = keyof SecretaryPermissions;
@@ -96,6 +97,15 @@ const PERMISSION_LABELS: Record<PermSection, { label: string; actions: { key: st
       { key: 'delete', label: 'حذف' },
     ],
   },
+  services: {
+    label: 'خدمات و تعرفه‌ها',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'ایجاد' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
 };
 
 function PermissionsMatrix({