feat(secretary): grant staff/discounts/sms/appointment_settings/clinic_doctors (phase B)

Extends the secretary permission system to five previously owner-only modules,
so a clinic/doctor can delegate each page to a secretary. All were unreachable
by secretaries before (role-based tenant resolution returned "unknown" → 403).

New permission resources (default-deny, three-place add: entity default,
SecretaryPermissions type, both MySecretariesPage + admin SecretariesPage):
staff, discounts, sms, appointment_settings (view/update only), clinic_doctors
(clinic-only — hidden from independent doctors via `clinicOnly` section filter).

Backend enforcement (SecretaryAccessChecker, three new reusable helpers):
- resolveOwnerEntity(): owner pair from active context — used by StaffController,
  DiscountController, SmsWalletController (now secretary-aware resolveEntity).
- canForDoctor(): per-doctor-scoped check (assigned doctor + toggle) — wired into
  AppointmentSettingsController::denyDoctorAccess.
- canForClinic(): clinic-scoped check — wired into ClinicController::detachDoctor,
  ClinicDoctorPermissionController (view/update), ClinicInvitationController
  (create/view/update/delete). clinic_doctors is clinic-context only.
Guards run ahead of any subscription gate; non-secretary roles pass unchanged.

Frontend:
- RoleRoute: staff, discounts, sms-wallet, appointment-settings (doctor+clinic
  variants), settings/clinic-doctors routes accept secretary + permission gate.
- Sidebar (secretary branch): five new items gated by can(); appointment_settings
  route follows active scope; clinic_doctors only in clinic scope.

Tests: SecretaryResourceEnforcementTest — denied-by-default + allowed-when-granted
for all five (18 total). Sidebar.test — B-resource gating + clinic_doctors scope
rule. docs/api/secretary.md resource list, enforcement map, JSON example updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/types/index.ts

@@ -508,6 +508,34 @@ export interface SecretaryPermissions {
         update: boolean;
         delete: boolean;
     };
+    staff: {
+        view: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
+    discounts: {
+        view: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
+    sms: {
+        view: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
+    appointment_settings: {
+        view: boolean;
+        update: boolean;
+    };
+    clinic_doctors: {
+        view: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
 }
 
 export interface Specialty {