feat(secretary): grant staff/discounts/sms/appointment_settings/clinic_doctors (phase B)

Extends the secretary permission system to five previously owner-only modules,
so a clinic/doctor can delegate each page to a secretary. All were unreachable
by secretaries before (role-based tenant resolution returned "unknown" → 403).

New permission resources (default-deny, three-place add: entity default,
SecretaryPermissions type, both MySecretariesPage + admin SecretariesPage):
staff, discounts, sms, appointment_settings (view/update only), clinic_doctors
(clinic-only — hidden from independent doctors via `clinicOnly` section filter).

Backend enforcement (SecretaryAccessChecker, three new reusable helpers):
- resolveOwnerEntity(): owner pair from active context — used by StaffController,
  DiscountController, SmsWalletController (now secretary-aware resolveEntity).
- canForDoctor(): per-doctor-scoped check (assigned doctor + toggle) — wired into
  AppointmentSettingsController::denyDoctorAccess.
- canForClinic(): clinic-scoped check — wired into ClinicController::detachDoctor,
  ClinicDoctorPermissionController (view/update), ClinicInvitationController
  (create/view/update/delete). clinic_doctors is clinic-context only.
Guards run ahead of any subscription gate; non-secretary roles pass unchanged.

Frontend:
- RoleRoute: staff, discounts, sms-wallet, appointment-settings (doctor+clinic
  variants), settings/clinic-doctors routes accept secretary + permission gate.
- Sidebar (secretary branch): five new items gated by can(); appointment_settings
  route follows active scope; clinic_doctors only in clinic scope.

Tests: SecretaryResourceEnforcementTest — denied-by-default + allowed-when-granted
for all five (18 total). Sidebar.test — B-resource gating + clinic_doctors scope
rule. docs/api/secretary.md resource list, enforcement map, JSON example updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/Sms/Controller/SmsWalletController.php

@@ -38,6 +38,7 @@ class SmsWalletController extends BaseController
         private readonly DoctorRepository               $doctorRepo,
         private readonly ClinicRepository               $clinicRepo,
         private readonly \App\Config\Repository\SiteConfigRepository $configRepo,
+        private readonly \App\Secretary\Security\SecretaryAccessChecker $secretaryAccess,
         private readonly string $appBaseUrl,
     ) {}
 
@@ -50,6 +51,7 @@ class SmsWalletController extends BaseController
     #[Route('/api/v1/sms/wallet/balance', methods: ['GET'])]
     public function balance(#[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'sms', 'view');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -69,6 +71,7 @@ class SmsWalletController extends BaseController
     #[Route('/api/v1/sms/wallet/charge', methods: ['POST'])]
     public function charge(Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'sms', 'create');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -102,6 +105,7 @@ class SmsWalletController extends BaseController
     #[Route('/api/v1/sms/wallet/logs', methods: ['GET'])]
     public function logs(Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'sms', 'view');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -125,6 +129,7 @@ class SmsWalletController extends BaseController
     #[Route('/api/v1/sms/settings', methods: ['GET'])]
     public function getSettings(#[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'sms', 'view');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -149,6 +154,7 @@ class SmsWalletController extends BaseController
     #[Route('/api/v1/sms/settings', methods: ['PATCH'])]
     public function updateSettings(Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'sms', 'update');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -281,6 +287,11 @@ class SmsWalletController extends BaseController
             return $clinic !== null ? ['clinic', $clinic->getId()] : ['clinic', null];
         }
 
+        // منشی روی tenantِ محیطِ فعال؛ مجوز جدا با denyUnlessGranted.
+        if ($user->hasRole('ROLE_SECRETARY')) {
+            return $this->secretaryAccess->resolveOwnerEntity($user);
+        }
+
         return ['unknown', null];
     }
 }