fix(secretary): gate CRUD action buttons across all panel pages by permission

Backend already returned 403 for ungranted secretary actions, but the UI still
showed the add/edit/delete buttons (e.g. clinic-services showed «بخش جدید» to a
secretary without services.create). Sweep every secretary-reachable page so each
create/edit/delete/manage control renders only when the matching
usePermissions().can(resource, action) is true. Owner/doctor/clinic are
unaffected — can() returns true when there is no permission context — so this
restricts only secretaries and mirrors the server checks.

Pages/components gated (resource):
- services: ClinicServicesPage, ServiceDetailPage (+ its tabs)
- inventory: InventoryPage, InventoryItemsTable, InventoryActionsMenu, PackagesView
- tags: TagsSettingsPage · staff: StaffPage · discounts: DiscountTab
- sms: SmsWalletPage · insurances: TenantInsuranceContracts
- clinic_doctors: ClinicDoctorsPage + ClinicDoctorsManager (props, default true)
- patients: PatientsListPage, MyPatientsPage, PatientDetailPage (records/notes/
  sessions/attachments/calls/wallet — create/update/delete split)
- appointments: AppointmentsPage (add + empty-slot booking gated by create),
  TurnsTable (status dropdown → read-only badge without update_status; actions
  menu hidden without manage/cancel)
- appointment_settings: AppointmentSettingsPage + ClinicAppointmentSettingsPage
  pass readOnly to ScheduleSection + FreeVisitPrice (new readOnly prop)

Not gated: view/read, search, filter, tabs, navigation, export, and modal
submit buttons reachable only via an already-gated trigger.

tsc clean; full frontend suite 501/501 passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/pages/AppointmentSettingsPage.tsx

@@ -8,6 +8,7 @@ import FreeVisitPrice from '../components/FreeVisitPrice';
 import { ScheduleSection } from '../components/schedule/ScheduleSection';
 import type { AddressData } from '../components/schedule/ScheduleSection';
 import SearchableSelect from '../components/ui/SearchableSelect';
+import { usePermissions } from '../hooks/usePermissions';
 
 const PERSONAL = 'personal';
 
@@ -25,6 +26,9 @@ export default function AppointmentSettingsPage() {
   const doctorUuid = useAuthStore((s) => s.doctorUuid);
   const dbUuid     = useAuthStore((s) => s.dbUuid);
   const uuid = doctorUuid ?? dbUuid ?? undefined;
+  const { can } = usePermissions();
+  // منشیِ بدون مجوزِ ویرایشِ تنظیمات نوبت‌دهی، فقط مشاهده می‌کند.
+  const apptReadOnly = !can('appointment_settings', 'update');
 
   // کلینیک‌هایی که پزشک عضوشان است (منبع: پروفایل خود پزشک).
   const profileQ = useQuery({
@@ -73,7 +77,7 @@ export default function AppointmentSettingsPage() {
       >
         <h1 className="section-title" style={{ marginBottom: 16 }}>مدیریت نوبت دهی</h1>
 
-        <FreeVisitPrice />
+        <FreeVisitPrice readOnly={apptReadOnly} />
 
         {!uuid ? (
           <div className="card" style={{ padding: 32, textAlign: 'center', color: 'var(--text-3)', fontSize: 14 }}>
@@ -94,7 +98,7 @@ export default function AppointmentSettingsPage() {
                 />
               </div>
             )}
-            <ScheduleSection doctorUuid={uuid} clinicUuid={clinicUuid} />
+            <ScheduleSection doctorUuid={uuid} clinicUuid={clinicUuid} readOnly={apptReadOnly} />
           </>
         )}
       </div>