fix(secretary): gate CRUD action buttons across all panel pages by permission

Backend already returned 403 for ungranted secretary actions, but the UI still
showed the add/edit/delete buttons (e.g. clinic-services showed «بخش جدید» to a
secretary without services.create). Sweep every secretary-reachable page so each
create/edit/delete/manage control renders only when the matching
usePermissions().can(resource, action) is true. Owner/doctor/clinic are
unaffected — can() returns true when there is no permission context — so this
restricts only secretaries and mirrors the server checks.

Pages/components gated (resource):
- services: ClinicServicesPage, ServiceDetailPage (+ its tabs)
- inventory: InventoryPage, InventoryItemsTable, InventoryActionsMenu, PackagesView
- tags: TagsSettingsPage · staff: StaffPage · discounts: DiscountTab
- sms: SmsWalletPage · insurances: TenantInsuranceContracts
- clinic_doctors: ClinicDoctorsPage + ClinicDoctorsManager (props, default true)
- patients: PatientsListPage, MyPatientsPage, PatientDetailPage (records/notes/
  sessions/attachments/calls/wallet — create/update/delete split)
- appointments: AppointmentsPage (add + empty-slot booking gated by create),
  TurnsTable (status dropdown → read-only badge without update_status; actions
  menu hidden without manage/cancel)
- appointment_settings: AppointmentSettingsPage + ClinicAppointmentSettingsPage
  pass readOnly to ScheduleSection + FreeVisitPrice (new readOnly prop)

Not gated: view/read, search, filter, tabs, navigation, export, and modal
submit buttons reachable only via an already-gated trigger.

tsc clean; full frontend suite 501/501 passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/pages/InventoryPage.tsx

@@ -9,6 +9,7 @@ import InventoryItemsTable from '../components/inventory/InventoryItemsTable';
 import PackagesView from '../components/inventory/PackagesView';
 import AddItemModal from '../components/inventory/AddItemModal';
 import AddPackageModal from '../components/inventory/AddPackageModal';
+import { usePermissions } from '../hooks/usePermissions';
 
 type Tab = 'stock' | 'packages';
 
@@ -19,6 +20,10 @@ export default function InventoryPage() {
     createItem, updateItem, deleteItem, createPackage, updatePackage, deletePackage,
   } = useInventory();
 
+  // مجوزهای منشی؛ برای owner/پزشک همیشه true (usePermissions بدون context آزاد است).
+  const { can } = usePermissions();
+  const canCreate = can('inventory', 'create');
+
   const [tab, setTab] = useState<Tab>('stock');
   const [search, setSearch] = useState('');
   const [category, setCategory] = useState('');
@@ -80,15 +85,19 @@ export default function InventoryPage() {
                 />
               </div>
             </div>
-            <button className="btn primary" onClick={() => setItemModal({ open: true, editing: null })}>
-              <PlusIcon style={{ width: 16 }} /> افزودن کالا
-            </button>
+            {canCreate && (
+              <button className="btn primary" onClick={() => setItemModal({ open: true, editing: null })}>
+                <PlusIcon style={{ width: 16 }} /> افزودن کالا
+              </button>
+            )}
           </div>
         ) : (
           <div style={{ display: 'flex', justifyContent: 'flex-end' }}>
-            <button className="btn primary" onClick={() => setPkgModal({ open: true, editing: null })}>
-              <PlusIcon style={{ width: 16 }} /> افزودن پکیج
-            </button>
+            {canCreate && (
+              <button className="btn primary" onClick={() => setPkgModal({ open: true, editing: null })}>
+                <PlusIcon style={{ width: 16 }} /> افزودن پکیج
+              </button>
+            )}
           </div>
         )}
       </div>