fix(secretary): gate CRUD action buttons across all panel pages by permission

Backend already returned 403 for ungranted secretary actions, but the UI still
showed the add/edit/delete buttons (e.g. clinic-services showed «بخش جدید» to a
secretary without services.create). Sweep every secretary-reachable page so each
create/edit/delete/manage control renders only when the matching
usePermissions().can(resource, action) is true. Owner/doctor/clinic are
unaffected — can() returns true when there is no permission context — so this
restricts only secretaries and mirrors the server checks.

Pages/components gated (resource):
- services: ClinicServicesPage, ServiceDetailPage (+ its tabs)
- inventory: InventoryPage, InventoryItemsTable, InventoryActionsMenu, PackagesView
- tags: TagsSettingsPage · staff: StaffPage · discounts: DiscountTab
- sms: SmsWalletPage · insurances: TenantInsuranceContracts
- clinic_doctors: ClinicDoctorsPage + ClinicDoctorsManager (props, default true)
- patients: PatientsListPage, MyPatientsPage, PatientDetailPage (records/notes/
  sessions/attachments/calls/wallet — create/update/delete split)
- appointments: AppointmentsPage (add + empty-slot booking gated by create),
  TurnsTable (status dropdown → read-only badge without update_status; actions
  menu hidden without manage/cancel)
- appointment_settings: AppointmentSettingsPage + ClinicAppointmentSettingsPage
  pass readOnly to ScheduleSection + FreeVisitPrice (new readOnly prop)

Not gated: view/read, search, filter, tabs, navigation, export, and modal
submit buttons reachable only via an already-gated trigger.

tsc clean; full frontend suite 501/501 passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/components/inventory/InventoryItemsTable.tsx

@@ -4,6 +4,7 @@ import { formatRial, formatNumber } from '../../lib/utils';
 import type { InventoryItem } from '../../hooks/useInventory';
 import InventoryStatusBadge from './InventoryStatusBadge';
 import InventoryActionsMenu from './InventoryActionsMenu';
+import { usePermissions } from '../../hooks/usePermissions';
 
 interface Props {
   items: InventoryItem[];
@@ -15,6 +16,9 @@ const HEAD = ['نام کالا', 'دسته‌بندی', 'موجودی', 'واح
 
 /** Consumable-items list: desktop table + mobile card grid (tauri InventoryList). */
 export default function InventoryItemsTable({ items, onEdit, onDelete }: Props) {
+  const { can } = usePermissions();
+  const canUpdate = can('inventory', 'update');
+  const canDelete = can('inventory', 'delete');
   return (
     <div style={{ width: '100%' }}>
       {/* Desktop table */}
@@ -75,14 +79,20 @@ export default function InventoryItemsTable({ items, onEdit, onDelete }: Props)
                 )}
               </div>
             ))}
-            <div style={{ display: 'flex', justifyContent: 'flex-end', gap: 8, marginTop: 12 }}>
-              <button className="btn sm ghost" aria-label="ویرایش" onClick={() => onEdit(item)} style={{ color: 'var(--text-2)' }}>
-                <PencilSquareIcon style={{ width: 16 }} />
-              </button>
-              <button className="btn sm ghost" aria-label="حذف" onClick={() => onDelete(item)} style={{ color: 'var(--danger)' }}>
-                <TrashIcon style={{ width: 16 }} />
-              </button>
-            </div>
+            {(canUpdate || canDelete) && (
+              <div style={{ display: 'flex', justifyContent: 'flex-end', gap: 8, marginTop: 12 }}>
+                {canUpdate && (
+                  <button className="btn sm ghost" aria-label="ویرایش" onClick={() => onEdit(item)} style={{ color: 'var(--text-2)' }}>
+                    <PencilSquareIcon style={{ width: 16 }} />
+                  </button>
+                )}
+                {canDelete && (
+                  <button className="btn sm ghost" aria-label="حذف" onClick={() => onDelete(item)} style={{ color: 'var(--danger)' }}>
+                    <TrashIcon style={{ width: 16 }} />
+                  </button>
+                )}
+              </div>
+            )}
           </li>
         ))}
       </ul>