feat(secretary): grant staff/discounts/sms/appointment_settings/clinic_doctors (phase B)

Extends the secretary permission system to five previously owner-only modules,
so a clinic/doctor can delegate each page to a secretary. All were unreachable
by secretaries before (role-based tenant resolution returned "unknown" → 403).

New permission resources (default-deny, three-place add: entity default,
SecretaryPermissions type, both MySecretariesPage + admin SecretariesPage):
staff, discounts, sms, appointment_settings (view/update only), clinic_doctors
(clinic-only — hidden from independent doctors via `clinicOnly` section filter).

Backend enforcement (SecretaryAccessChecker, three new reusable helpers):
- resolveOwnerEntity(): owner pair from active context — used by StaffController,
  DiscountController, SmsWalletController (now secretary-aware resolveEntity).
- canForDoctor(): per-doctor-scoped check (assigned doctor + toggle) — wired into
  AppointmentSettingsController::denyDoctorAccess.
- canForClinic(): clinic-scoped check — wired into ClinicController::detachDoctor,
  ClinicDoctorPermissionController (view/update), ClinicInvitationController
  (create/view/update/delete). clinic_doctors is clinic-context only.
Guards run ahead of any subscription gate; non-secretary roles pass unchanged.

Frontend:
- RoleRoute: staff, discounts, sms-wallet, appointment-settings (doctor+clinic
  variants), settings/clinic-doctors routes accept secretary + permission gate.
- Sidebar (secretary branch): five new items gated by can(); appointment_settings
  route follows active scope; clinic_doctors only in clinic scope.

Tests: SecretaryResourceEnforcementTest — denied-by-default + allowed-when-granted
for all five (18 total). Sidebar.test — B-resource gating + clinic_doctors scope
rule. docs/api/secretary.md resource list, enforcement map, JSON example updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/ClinicInvitation/Controller/ClinicInvitationController.php

@@ -26,6 +26,7 @@ class ClinicInvitationController extends BaseController
         private readonly ClinicDoctorInvitationRepository $invRepo,
         private readonly ClinicRepository                 $clinicRepo,
         private readonly DoctorRepository                 $doctorRepo,
+        private readonly \App\Secretary\Security\SecretaryAccessChecker $secretaryAccess,
     ) {}
 
     // ── Admin endpoints ──────────────────────────────────────────────────────
@@ -39,7 +40,7 @@ class ClinicInvitationController extends BaseController
             throw new AppException('ERR_NOT_FOUND_001', 'کلینیک یافت نشد', 404);
         }
 
-        $this->assertClinicAccess($clinic, $user);
+        $this->assertClinicAccess($clinic, $user, 'create');
 
         $body      = json_decode($request->getContent(), true) ?? [];
         $mobile    = trim($body['mobile'] ?? '');
@@ -64,7 +65,7 @@ class ClinicInvitationController extends BaseController
             throw new AppException('ERR_NOT_FOUND_001', 'کلینیک یافت نشد', 404);
         }
 
-        $this->assertClinicAccess($clinic, $user);
+        $this->assertClinicAccess($clinic, $user, 'view');
 
         $page  = max(1, (int) $request->query->get('page', 1));
         $limit = min(50, max(1, (int) $request->query->get('limit', 20)));
@@ -96,7 +97,7 @@ class ClinicInvitationController extends BaseController
             throw new AppException('ERR_NOT_FOUND_001', 'دعوتنامه یافت نشد', 404);
         }
 
-        $this->assertClinicAccess($inv->getClinic(), $user);
+        $this->assertClinicAccess($inv->getClinic(), $user, 'create');
         $this->invitationService->resend($inv);
 
         return $this->success(['message' => 'پیامک مجدداً ارسال شد']);
@@ -111,7 +112,7 @@ class ClinicInvitationController extends BaseController
             throw new AppException('ERR_NOT_FOUND_001', 'دعوتنامه یافت نشد', 404);
         }
 
-        $this->assertClinicAccess($inv->getClinic(), $user);
+        $this->assertClinicAccess($inv->getClinic(), $user, 'update');
 
         $body   = json_decode($request->getContent(), true) ?? [];
         $status = $body['status'] ?? '';
@@ -130,7 +131,7 @@ class ClinicInvitationController extends BaseController
             throw new AppException('ERR_NOT_FOUND_001', 'دعوتنامه یافت نشد', 404);
         }
 
-        $this->assertClinicAccess($inv->getClinic(), $user);
+        $this->assertClinicAccess($inv->getClinic(), $user, 'delete');
         $this->invitationService->delete($inv);
 
         return $this->success(['message' => 'دعوتنامه حذف شد']);
@@ -193,7 +194,7 @@ class ClinicInvitationController extends BaseController
         throw new AppException('ERR_VALIDATION_001', 'action باید accept یا reject باشد', 422);
     }
 
-    private function assertClinicAccess(\App\Clinic\Entity\Clinic $clinic, User $user): void
+    private function assertClinicAccess(\App\Clinic\Entity\Clinic $clinic, User $user, string $action = 'view'): void
     {
         if ($user->hasRole('ROLE_ADMIN')) {
             return;
@@ -201,6 +202,10 @@ class ClinicInvitationController extends BaseController
         if ($user->hasRole('ROLE_CLINIC') && $clinic->getUser()->getId() === $user->getId()) {
             return;
         }
+        // منشیِ همان کلینیک با توگلِ clinic_doctors می‌تواند پزشکان را دعوت/مدیریت کند.
+        if ($this->secretaryAccess->canForClinic($user, $clinic, 'clinic_doctors', $action)) {
+            return;
+        }
         throw new AppException(ErrorCodes::ERR_ACCESS_DENIED, 'دسترسی ندارید', 403);
     }