fix(secretary): gate CRUD action buttons across all panel pages by permission

Backend already returned 403 for ungranted secretary actions, but the UI still
showed the add/edit/delete buttons (e.g. clinic-services showed «بخش جدید» to a
secretary without services.create). Sweep every secretary-reachable page so each
create/edit/delete/manage control renders only when the matching
usePermissions().can(resource, action) is true. Owner/doctor/clinic are
unaffected — can() returns true when there is no permission context — so this
restricts only secretaries and mirrors the server checks.

Pages/components gated (resource):
- services: ClinicServicesPage, ServiceDetailPage (+ its tabs)
- inventory: InventoryPage, InventoryItemsTable, InventoryActionsMenu, PackagesView
- tags: TagsSettingsPage · staff: StaffPage · discounts: DiscountTab
- sms: SmsWalletPage · insurances: TenantInsuranceContracts
- clinic_doctors: ClinicDoctorsPage + ClinicDoctorsManager (props, default true)
- patients: PatientsListPage, MyPatientsPage, PatientDetailPage (records/notes/
  sessions/attachments/calls/wallet — create/update/delete split)
- appointments: AppointmentsPage (add + empty-slot booking gated by create),
  TurnsTable (status dropdown → read-only badge without update_status; actions
  menu hidden without manage/cancel)
- appointment_settings: AppointmentSettingsPage + ClinicAppointmentSettingsPage
  pass readOnly to ScheduleSection + FreeVisitPrice (new readOnly prop)

Not gated: view/read, search, filter, tabs, navigation, export, and modal
submit buttons reachable only via an already-gated trigger.

tsc clean; full frontend suite 501/501 passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/pages/StaffPage.tsx

@@ -16,6 +16,7 @@ import PageHeader from '../components/ui/PageHeader';
 import SettingsLayout from '../components/layout/SettingsLayout';
 import { ActiveBadge } from '../components/ui/StatusBadge';
 import { numericField } from '../lib/forms';
+import { usePermissions } from '../hooks/usePermissions';
 
 const schema = z.object({
   full_name: z.string().min(2, 'نام حداقل ۲ کاراکتر باید باشد'),
@@ -30,6 +31,10 @@ const EMPTY: ClinicStaff[] = [];
 
 export default function StaffPage() {
   const qc = useQueryClient();
+  // مجوزهای منشی؛ برای owner/پزشک همیشه true (usePermissions بدون context آزاد است).
+  const { can } = usePermissions();
+  const canCreate = can('staff', 'create');
+  const canUpdate = can('staff', 'update');
   const [createOpen, setCreateOpen] = useState(false);
   const [editTarget, setEditTarget] = useState<ClinicStaff | null>(null);
   const [toggleTarget, setToggleTarget] = useState<ClinicStaff | null>(null);
@@ -138,19 +143,23 @@ export default function StaffPage() {
       header: 'عملیات',
       render: (s) => (
         <div style={{ display: 'flex', gap: 6 }}>
-          <button className="btn sm" onClick={() => openEdit(s)} title="ویرایش">
-            <PencilIcon style={{ width: 15 }} />
-          </button>
-          <button
-            className="btn sm"
-            onClick={() => setToggleTarget(s)}
-            title={s.active ? 'غیرفعال‌سازی' : 'فعال‌سازی'}
-          >
-            {s.active
-              ? <EyeSlashIcon style={{ width: 15 }} />
-              : <EyeIcon style={{ width: 15 }} />
-            }
-          </button>
+          {canUpdate && (
+            <button className="btn sm" onClick={() => openEdit(s)} title="ویرایش">
+              <PencilIcon style={{ width: 15 }} />
+            </button>
+          )}
+          {canUpdate && (
+            <button
+              className="btn sm"
+              onClick={() => setToggleTarget(s)}
+              title={s.active ? 'غیرفعال‌سازی' : 'فعال‌سازی'}
+            >
+              {s.active
+                ? <EyeSlashIcon style={{ width: 15 }} />
+                : <EyeIcon style={{ width: 15 }} />
+              }
+            </button>
+          )}
         </div>
       ),
     },
@@ -162,9 +171,11 @@ export default function StaffPage() {
         title="مدیریت پرسنل"
         description="لیست پرسنل کلینیک / مطب"
         action={
-          <button className="btn primary sm" onClick={() => setCreateOpen(true)}>
-            <PlusIcon style={{ width: 16 }} /> افزودن پرسنل
-          </button>
+          canCreate ? (
+            <button className="btn primary sm" onClick={() => setCreateOpen(true)}>
+              <PlusIcon style={{ width: 16 }} /> افزودن پرسنل
+            </button>
+          ) : undefined
         }
       />
 
@@ -192,9 +203,11 @@ export default function StaffPage() {
             <UserGroupIcon style={{ width: 48, margin: '0 auto 16px', display: 'block', opacity: 0.4 }} />
             <div style={{ fontWeight: 600, fontSize: 15, marginBottom: 8, color: 'var(--text-2)' }}>هنوز پرسنلی ثبت نشده</div>
             <div style={{ fontSize: 13, marginBottom: 20 }}>اولین عضو تیم خود را اضافه کنید</div>
-            <button className="btn primary sm" onClick={() => setCreateOpen(true)}>
-              <PlusIcon style={{ width: 16 }} /> افزودن پرسنل
-            </button>
+            {canCreate && (
+              <button className="btn primary sm" onClick={() => setCreateOpen(true)}>
+                <PlusIcon style={{ width: 16 }} /> افزودن پرسنل
+              </button>
+            )}
           </div>
         ) : (
           <DataTable columns={columns} data={staff} loading={isLoading} />