feat(secretary): grant staff/discounts/sms/appointment_settings/clinic_doctors (phase B)

Extends the secretary permission system to five previously owner-only modules,
so a clinic/doctor can delegate each page to a secretary. All were unreachable
by secretaries before (role-based tenant resolution returned "unknown" → 403).

New permission resources (default-deny, three-place add: entity default,
SecretaryPermissions type, both MySecretariesPage + admin SecretariesPage):
staff, discounts, sms, appointment_settings (view/update only), clinic_doctors
(clinic-only — hidden from independent doctors via `clinicOnly` section filter).

Backend enforcement (SecretaryAccessChecker, three new reusable helpers):
- resolveOwnerEntity(): owner pair from active context — used by StaffController,
  DiscountController, SmsWalletController (now secretary-aware resolveEntity).
- canForDoctor(): per-doctor-scoped check (assigned doctor + toggle) — wired into
  AppointmentSettingsController::denyDoctorAccess.
- canForClinic(): clinic-scoped check — wired into ClinicController::detachDoctor,
  ClinicDoctorPermissionController (view/update), ClinicInvitationController
  (create/view/update/delete). clinic_doctors is clinic-context only.
Guards run ahead of any subscription gate; non-secretary roles pass unchanged.

Frontend:
- RoleRoute: staff, discounts, sms-wallet, appointment-settings (doctor+clinic
  variants), settings/clinic-doctors routes accept secretary + permission gate.
- Sidebar (secretary branch): five new items gated by can(); appointment_settings
  route follows active scope; clinic_doctors only in clinic scope.

Tests: SecretaryResourceEnforcementTest — denied-by-default + allowed-when-granted
for all five (18 total). Sidebar.test — B-resource gating + clinic_doctors scope
rule. docs/api/secretary.md resource list, enforcement map, JSON example updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/pages/SecretariesPage.tsx

@@ -22,6 +22,11 @@ const DEFAULT_PERMISSIONS: SecretaryPermissions = {
   inventory: { view: false, create: false, update: false, delete: false },
   tags: { view: false, create: false, update: false, delete: false },
   services: { view: false, create: false, update: false, delete: false },
+  staff: { view: false, create: false, update: false, delete: false },
+  discounts: { view: false, create: false, update: false, delete: false },
+  sms: { view: false, create: false, update: false, delete: false },
+  appointment_settings: { view: false, update: false },
+  clinic_doctors: { view: false, create: false, update: false, delete: false },
 };
 
 type PermSection = keyof SecretaryPermissions;
@@ -106,6 +111,49 @@ const PERMISSION_LABELS: Record<PermSection, { label: string; actions: { key: st
       { key: 'delete', label: 'حذف' },
     ],
   },
+  staff: {
+    label: 'پرسنل',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'ایجاد' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
+  discounts: {
+    label: 'تخفیف‌ها',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'ایجاد' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
+  sms: {
+    label: 'پیامک‌ها',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'شارژ/ارسال' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
+  appointment_settings: {
+    label: 'تنظیمات نوبت‌دهی',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'update', label: 'ویرایش' },
+    ],
+  },
+  clinic_doctors: {
+    label: 'مدیریت پزشکان کلینیک',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'ایجاد' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
 };
 
 function PermissionsMatrix({