fix(secretary): gate CRUD action buttons across all panel pages by permission

Backend already returned 403 for ungranted secretary actions, but the UI still
showed the add/edit/delete buttons (e.g. clinic-services showed «بخش جدید» to a
secretary without services.create). Sweep every secretary-reachable page so each
create/edit/delete/manage control renders only when the matching
usePermissions().can(resource, action) is true. Owner/doctor/clinic are
unaffected — can() returns true when there is no permission context — so this
restricts only secretaries and mirrors the server checks.

Pages/components gated (resource):
- services: ClinicServicesPage, ServiceDetailPage (+ its tabs)
- inventory: InventoryPage, InventoryItemsTable, InventoryActionsMenu, PackagesView
- tags: TagsSettingsPage · staff: StaffPage · discounts: DiscountTab
- sms: SmsWalletPage · insurances: TenantInsuranceContracts
- clinic_doctors: ClinicDoctorsPage + ClinicDoctorsManager (props, default true)
- patients: PatientsListPage, MyPatientsPage, PatientDetailPage (records/notes/
  sessions/attachments/calls/wallet — create/update/delete split)
- appointments: AppointmentsPage (add + empty-slot booking gated by create),
  TurnsTable (status dropdown → read-only badge without update_status; actions
  menu hidden without manage/cancel)
- appointment_settings: AppointmentSettingsPage + ClinicAppointmentSettingsPage
  pass readOnly to ScheduleSection + FreeVisitPrice (new readOnly prop)

Not gated: view/read, search, filter, tabs, navigation, export, and modal
submit buttons reachable only via an already-gated trigger.

tsc clean; full frontend suite 501/501 passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/pages/ClinicDoctorsPage.tsx

@@ -2,6 +2,7 @@ import { useEffect, useMemo } from 'react';
 import { Link } from 'react-router-dom';
 import { PencilIcon } from '@heroicons/react/24/outline';
 import { useAuthStore } from '../stores/authStore';
+import { usePermissions } from '../hooks/usePermissions';
 import SettingsLayout from '../components/layout/SettingsLayout';
 import ClinicDoctorsManager from '../components/ClinicDoctorsManager';
 
@@ -14,6 +15,11 @@ import ClinicDoctorsManager from '../components/ClinicDoctorsManager';
  */
 function ClinicDoctorsContent() {
   const { dbUuid, context, availableContexts, fetchMe } = useAuthStore();
+  // مجوزهای منشی؛ برای owner/کلینیک همیشه true (usePermissions بدون context آزاد است).
+  const { can } = usePermissions();
+  const canCreate = can('clinic_doctors', 'create');
+  const canUpdate = can('clinic_doctors', 'update');
+  const canDelete = can('clinic_doctors', 'delete');
 
   useEffect(() => {
     if (!dbUuid) fetchMe();
@@ -48,7 +54,12 @@ function ClinicDoctorsContent() {
         </Link>
       </div>
 
-      <ClinicDoctorsManager clinicUuid={clinicUuid} />
+      <ClinicDoctorsManager
+        clinicUuid={clinicUuid}
+        canCreate={canCreate}
+        canUpdate={canUpdate}
+        canDelete={canDelete}
+      />
     </div>
   );
 }