fix(secretary): gate CRUD action buttons across all panel pages by permission

Backend already returned 403 for ungranted secretary actions, but the UI still
showed the add/edit/delete buttons (e.g. clinic-services showed «بخش جدید» to a
secretary without services.create). Sweep every secretary-reachable page so each
create/edit/delete/manage control renders only when the matching
usePermissions().can(resource, action) is true. Owner/doctor/clinic are
unaffected — can() returns true when there is no permission context — so this
restricts only secretaries and mirrors the server checks.

Pages/components gated (resource):
- services: ClinicServicesPage, ServiceDetailPage (+ its tabs)
- inventory: InventoryPage, InventoryItemsTable, InventoryActionsMenu, PackagesView
- tags: TagsSettingsPage · staff: StaffPage · discounts: DiscountTab
- sms: SmsWalletPage · insurances: TenantInsuranceContracts
- clinic_doctors: ClinicDoctorsPage + ClinicDoctorsManager (props, default true)
- patients: PatientsListPage, MyPatientsPage, PatientDetailPage (records/notes/
  sessions/attachments/calls/wallet — create/update/delete split)
- appointments: AppointmentsPage (add + empty-slot booking gated by create),
  TurnsTable (status dropdown → read-only badge without update_status; actions
  menu hidden without manage/cancel)
- appointment_settings: AppointmentSettingsPage + ClinicAppointmentSettingsPage
  pass readOnly to ScheduleSection + FreeVisitPrice (new readOnly prop)

Not gated: view/read, search, filter, tabs, navigation, export, and modal
submit buttons reachable only via an already-gated trigger.

tsc clean; full frontend suite 501/501 passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/pages/ServiceDetailPage.tsx

@@ -14,6 +14,7 @@ import { formatRial, formatNumber, formatYear, formatDateTime } from '../lib/uti
 import PageHeader from '../components/ui/PageHeader';
 import FeatureGate from '../components/ui/FeatureGate';
 import ConfirmDialog from '../components/ui/ConfirmDialog';
+import { usePermissions } from '../hooks/usePermissions';
 import ServiceTariffModal from '../components/ServiceTariffModal';
 import ServiceInsuranceModal from '../components/ServiceInsuranceModal';
 import ServiceItemFormModal from '../components/ServiceItemFormModal';
@@ -160,7 +161,7 @@ function InfoTab({ item }: { item: ServiceItem }) {
   );
 }
 
-function TariffsTab({ item, onManage }: { item: ServiceItem; onManage: () => void }) {
+function TariffsTab({ item, onManage, canUpdate }: { item: ServiceItem; onManage: () => void; canUpdate: boolean }) {
   const { data, isLoading } = useQuery<ApiResponse<TariffList>>({
     queryKey: ['service-tariffs', item.uuid],
     queryFn: () => api.get(`/api/v1/service-items/${item.uuid}/tariffs`),
@@ -178,7 +179,7 @@ function TariffsTab({ item, onManage }: { item: ServiceItem; onManage: () => voi
             قیمت هر سال شمسی؛ قیمت سال جاری مبنای صورتحساب است.
           </div>
         </div>
-        <button className="btn primary sm" onClick={onManage}>مدیریت تعرفه‌ها</button>
+        {canUpdate && <button className="btn primary sm" onClick={onManage}>مدیریت تعرفه‌ها</button>}
       </div>
 
       {isLoading ? (
@@ -211,7 +212,7 @@ function TariffsTab({ item, onManage }: { item: ServiceItem; onManage: () => voi
   );
 }
 
-function InsuranceTab({ item, onManage }: { item: ServiceItem; onManage: () => void }) {
+function InsuranceTab({ item, onManage, canUpdate }: { item: ServiceItem; onManage: () => void; canUpdate: boolean }) {
   const { data: contractsData, isLoading } = useQuery<{ data: { data: TenantInsurance[] } }>({
     queryKey: ['tenant-insurances'],
     queryFn: () => api.get('/api/v1/billing/tenant-insurances'),
@@ -228,7 +229,7 @@ function InsuranceTab({ item, onManage }: { item: ServiceItem; onManage: () => v
             درصد پوشش، فرانشیز و سقف هر بیمه‌گر برای این خدمت.
           </div>
         </div>
-        <button className="btn primary sm" onClick={onManage}>مدیریت پوشش</button>
+        {canUpdate && <button className="btn primary sm" onClick={onManage}>مدیریت پوشش</button>}
       </div>
 
       {isLoading ? (
@@ -286,7 +287,7 @@ function ContractCoverageRow({ contract, itemUuid }: { contract: TenantInsurance
   );
 }
 
-function GoodsTab({ item, onEdit }: { item: ServiceItem; onEdit: () => void }) {
+function GoodsTab({ item, onEdit, canUpdate }: { item: ServiceItem; onEdit: () => void; canUpdate: boolean }) {
   const { data, isLoading } = useQuery<ApiResponse<InventoryPackage[]>>({
     queryKey: ['inventory-packages'],
     queryFn: () => api.get('/api/v1/inventory-packages'),
@@ -305,7 +306,7 @@ function GoodsTab({ item, onEdit }: { item: ServiceItem; onEdit: () => void }) {
             پکیج آماده و کالاهای تکیِ مصرفی این خدمت؛ در «انبار» ساخته و در فرم سرویس انتخاب می‌شوند.
           </div>
         </div>
-        <button className="btn primary sm" onClick={onEdit}>ویرایش کالاها</button>
+        {canUpdate && <button className="btn primary sm" onClick={onEdit}>ویرایش کالاها</button>}
       </div>
 
       {isLoading ? (
@@ -447,6 +448,9 @@ function ServiceDetailPageInner() {
   const { uuid } = useParams<{ uuid: string }>();
   const navigate = useNavigate();
   const qc = useQueryClient();
+  // مجوز منشی؛ برای owner/پزشک همیشه true (usePermissions بدون context آزاد است).
+  const { can } = usePermissions();
+  const canUpdate = can('services', 'update');
 
   const [tab, setTab] = useState<TabId>('info');
   const [editOpen, setEditOpen] = useState(false);
@@ -497,14 +501,16 @@ function ServiceDetailPageInner() {
           { label: item.name },
         ]}
         action={
-          <div style={{ display: 'flex', gap: 8 }}>
-            <button className="btn sm" onClick={() => setToggleOpen(true)}>
-              {item.active ? 'غیرفعال‌کردن' : 'فعال‌کردن'}
-            </button>
-            <button className="btn primary sm" onClick={() => setEditOpen(true)}>
-              <PencilIcon style={{ width: 15 }} /> ویرایش
-            </button>
-          </div>
+          canUpdate ? (
+            <div style={{ display: 'flex', gap: 8 }}>
+              <button className="btn sm" onClick={() => setToggleOpen(true)}>
+                {item.active ? 'غیرفعال‌کردن' : 'فعال‌کردن'}
+              </button>
+              <button className="btn primary sm" onClick={() => setEditOpen(true)}>
+                <PencilIcon style={{ width: 15 }} /> ویرایش
+              </button>
+            </div>
+          ) : undefined
         }
       />
 
@@ -528,9 +534,9 @@ function ServiceDetailPageInner() {
       </div>
 
       {tab === 'info'      && <InfoTab item={item} />}
-      {tab === 'tariffs'   && <TariffsTab item={item} onManage={() => setTariffOpen(true)} />}
-      {tab === 'insurance' && <InsuranceTab item={item} onManage={() => setInsuranceOpen(true)} />}
-      {tab === 'goods'     && <GoodsTab item={item} onEdit={() => setEditOpen(true)} />}
+      {tab === 'tariffs'   && <TariffsTab item={item} onManage={() => setTariffOpen(true)} canUpdate={canUpdate} />}
+      {tab === 'insurance' && <InsuranceTab item={item} onManage={() => setInsuranceOpen(true)} canUpdate={canUpdate} />}
+      {tab === 'goods'     && <GoodsTab item={item} onEdit={() => setEditOpen(true)} canUpdate={canUpdate} />}
       {tab === 'history'   && <HistoryTab item={item} />}
 
       <ServiceItemFormModal