feat(secretary): grant staff/discounts/sms/appointment_settings/clinic_doctors (phase B)

Extends the secretary permission system to five previously owner-only modules,
so a clinic/doctor can delegate each page to a secretary. All were unreachable
by secretaries before (role-based tenant resolution returned "unknown" → 403).

New permission resources (default-deny, three-place add: entity default,
SecretaryPermissions type, both MySecretariesPage + admin SecretariesPage):
staff, discounts, sms, appointment_settings (view/update only), clinic_doctors
(clinic-only — hidden from independent doctors via `clinicOnly` section filter).

Backend enforcement (SecretaryAccessChecker, three new reusable helpers):
- resolveOwnerEntity(): owner pair from active context — used by StaffController,
  DiscountController, SmsWalletController (now secretary-aware resolveEntity).
- canForDoctor(): per-doctor-scoped check (assigned doctor + toggle) — wired into
  AppointmentSettingsController::denyDoctorAccess.
- canForClinic(): clinic-scoped check — wired into ClinicController::detachDoctor,
  ClinicDoctorPermissionController (view/update), ClinicInvitationController
  (create/view/update/delete). clinic_doctors is clinic-context only.
Guards run ahead of any subscription gate; non-secretary roles pass unchanged.

Frontend:
- RoleRoute: staff, discounts, sms-wallet, appointment-settings (doctor+clinic
  variants), settings/clinic-doctors routes accept secretary + permission gate.
- Sidebar (secretary branch): five new items gated by can(); appointment_settings
  route follows active scope; clinic_doctors only in clinic scope.

Tests: SecretaryResourceEnforcementTest — denied-by-default + allowed-when-granted
for all five (18 total). Sidebar.test — B-resource gating + clinic_doctors scope
rule. docs/api/secretary.md resource list, enforcement map, JSON example updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/Secretary/Security/SecretaryAccessChecker.php

@@ -85,6 +85,58 @@ class SecretaryAccessChecker
         return ['unknown', null];
     }
 
+    /**
+     * آیا منشی در محیطِ فعالِ خود، روی این پزشکِ مشخص (و کلینیکِ همان نوبت/تنظیم)
+     * مجاز به resource/action است؟ ترکیبِ «اسکوپِ پزشکِ تخصیص‌یافته» و «توگلِ مجوز».
+     * قرینهٔ AppointmentAccessChecker::secretaryCan اما برای هر resource.
+     */
+    public function canForDoctor(
+        User $user,
+        \App\Doctor\Entity\Doctor $doctor,
+        ?\App\Clinic\Entity\Clinic $clinic,
+        string $resource,
+        string $action
+    ): bool {
+        $dbUuid = $this->contextRepo->findByUser($user)?->getDbUuid();
+        if ($dbUuid === null) {
+            return false;
+        }
+
+        $ctxClinic = $this->clinicRepo->findByUuid($dbUuid);
+        if ($ctxClinic !== null) {
+            // محیطِ کلینیک: تنظیم باید در همان کلینیک باشد و پزشکش جزو پزشکانِ منشی.
+            if ($clinic === null || $ctxClinic->getId() !== $clinic->getId()) {
+                return false;
+            }
+            $relation = $this->secretaryRepo->findActiveClinicRow($user, $ctxClinic, $doctor);
+
+            return $relation !== null && $this->permissions->can($relation, $resource, $action);
+        }
+
+        // محیطِ مطب شخصی: تنظیم هم باید شخصی باشد (clinic == null).
+        if ($clinic !== null) {
+            return false;
+        }
+        $ctxDoctor = $this->doctorRepo->findByUuid($dbUuid);
+        if ($ctxDoctor === null || $ctxDoctor->getId() !== $doctor->getId()) {
+            return false;
+        }
+        $relation = $this->secretaryRepo->findActiveBySecretaryForDoctor($user, $doctor);
+
+        return $relation !== null && $this->permissions->can($relation, $resource, $action);
+    }
+
+    /**
+     * آیا منشی در محیطِ فعالِ خود — که باید همین کلینیک باشد — مجاز به resource/action است؟
+     * برای منابعِ کلینیک‌سطح مثل clinic_doctors که tenant لزوماً کلینیک است.
+     */
+    public function canForClinic(User $user, \App\Clinic\Entity\Clinic $clinic, string $resource, string $action): bool
+    {
+        [$type, $id] = $this->resolveOwnerEntity($user);
+
+        return $type === 'clinic' && $id === $clinic->getId() && $this->can($user, $resource, $action);
+    }
+
     /**
      * برای مسیرهایی که چند نقش دارند: فقط منشی را محدود کن. سایر نقش‌ها true.
      */