feat(secretary): add services permission resource + panel gating (phase A)

Secretaries could reach neither the services module (EntityContextResolver
does not recognise a secretary as clinic owner, so they resolved to
`unknown` → 403) nor had any toggle to grant it. Add `services` as a
first-class secretary permission resource, enforced end-to-end.

Backend
- DoctorSecretary::DEFAULT_PERMISSIONS: new `services` resource (default-deny).
- SecretaryAccessChecker::resolveOwnerEntity(): reusable owner (clinic/doctor)
  resolution from the secretary's active context, for controllers whose data
  is fetched by [entityType, entityId] and whose generic resolver is not
  secretary-aware.
- ClinicServiceController: resolveEntity() is now secretary-aware; every action
  (sections, items, tariffs — 13 total) guards with `services` view/create/
  update/delete via denyUnlessGranted, ahead of the subscription gate.

Frontend
- SecretaryPermissions type + MySecretariesPage + SecretariesPage: `services`
  section so owners can grant it.
- Sidebar (secretary branch): services / inventory / tags menu items gated by
  can(resource, 'view').
- RoleRoute: a secretary now needs the page's `permission` to open it (direct
  URL entry included); clinic-services, inventory, tags-settings routes accept
  secretary + permission gate.

Tests
- SecretaryResourceEnforcementTest: services denied-by-default, allowed-when-
  granted, create-denied-while-view-granted.
- Sidebar.test: secretary menu gating for services/inventory/tags.

Docs: secretary.md + clinic-services.md updated with the `services` resource
and the resolveOwnerEntity note.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/Secretary/SecretaryResourceEnforcementTest.php

@@ -77,4 +77,41 @@ class SecretaryResourceEnforcementTest extends ApiTestCase
         $this->authJson('POST', '/api/v1/inventory-item', $secretary, ['name' => 'گاز استریل']);
         $this->assertSame(403, $this->responseCode());
     }
+
+    // service-items (listAllItems) فقط توگلِ permission را می‌سنجد — برخلاف
+    // service-sections که پیش از آن، گیتِ اشتراک (assertServicesGate) هم دارد.
+    public function testServicesDeniedByDefault(): void
+    {
+        // DEFAULT_PERMISSIONS: services.* = false
+        [$secretary] = $this->makeClinicSecretary();
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/service-items', $secretary);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testServicesAllowedWhenGranted(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => ['services' => ['view' => true]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/service-items', $secretary);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    public function testServicesCreateDeniedButViewGranted(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => ['services' => ['view' => true, 'create' => false]]]);
+        $this->em->flush();
+
+        // مشاهده مجاز
+        $this->authJson('GET', '/api/v1/service-items', $secretary);
+        $this->assertSame(200, $this->responseCode());
+
+        // ایجاد ممنوع — گیتِ permission پیش از گیتِ اشتراک اجرا می‌شود.
+        $this->authJson('POST', '/api/v1/service-section', $secretary, ['name' => 'بخش تست']);
+        $this->assertSame(403, $this->responseCode());
+    }
 }