feat(clinic-doctor): full permission coverage + enforcement, parity with secretary

The clinic-member-doctor permission system (ClinicDoctorPermission) lagged the
secretary system: only 6 resources, enforced in ~6 places, dead toggles
(services.update never checked), and a sidebar showing just appointments+patients.
Bring it to parity so a clinic owner can control exactly what each member doctor
does — while an independent doctor stays completely unrestricted.

Coverage: add insurances, addresses, inventory, tags, staff, discounts, sms to
ClinicDoctorPermission::DEFAULT_PERMISSIONS + DoctorPermissionsModal
(subscription/clinic_doctors stay owner-only by design).

New App\Clinic\Security\ClinicDoctorAccessChecker (parallel to
SecretaryAccessChecker):
- denyUnlessGranted(user, resource, action): 403 only for a clinic-member doctor
  in the clinic context; owner/admin/secretary/independent-doctor pass through.
- memberClinicId(user): resolves the member doctor to the CLINIC's tenant so the
  role-based controllers (Inventory/Tag/Staff/Discount/Sms) stop showing them
  their personal tenant in clinic context.

Enforcement wired into 10 controllers alongside the existing secretary gates:
ClinicService (services), Insurance (insurances), Patient (patients+payments),
Staff, Discount, Inventory, Tag, SmsWallet, Payment, PaymentMethod.

Frontend: the guest-doctor sidebar branch now exposes every permitted resource
(gated by can()) plus a «تنظیمات» entry; both settings navs (PurchaseSubscription
Sidebar + SETTINGS_MENU) are now permission-filtered for a scope=clinic doctor,
not just secretaries; my-payments route gets the missing payments permission.
CRUD-button gating already applies (usePermissions is role-agnostic).

Tests: ClinicDoctorPermissionEnforcementTest (member denied/allowed +
independent-doctor-unrestricted); guest-doctor sidebar gating. Backend 375 pass,
frontend 503 pass. docs/api/clinic.md updated with the full resource set +
enforcement notes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/Staff/Controller/StaffController.php

@@ -26,12 +26,14 @@ class StaffController extends BaseController
         private readonly DoctorRepository      $doctorRepo,
         private readonly ClinicRepository      $clinicRepo,
         private readonly SecretaryAccessChecker $secretaryAccess,
+        private readonly \App\Clinic\Security\ClinicDoctorAccessChecker $clinicDoctorAccess,
     ) {}
 
     #[Route('/api/v1/staff', methods: ['GET'])]
     public function list(#[CurrentUser] User $user): JsonResponse
     {
         $this->secretaryAccess->denyUnlessGranted($user, 'staff', 'view');
+        $this->clinicDoctorAccess->denyUnlessGranted($user, 'staff', 'view');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -49,6 +51,7 @@ class StaffController extends BaseController
     public function create(Request $request, #[CurrentUser] User $user): JsonResponse
     {
         $this->secretaryAccess->denyUnlessGranted($user, 'staff', 'create');
+        $this->clinicDoctorAccess->denyUnlessGranted($user, 'staff', 'create');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -76,6 +79,7 @@ class StaffController extends BaseController
     public function update(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
     {
         $this->secretaryAccess->denyUnlessGranted($user, 'staff', 'update');
+        $this->clinicDoctorAccess->denyUnlessGranted($user, 'staff', 'update');
         $staff = $this->staffRepo->findByUuid($uuid);
         if ($staff === null) {
             return $this->error(ErrorCodes::ERR_STAFF_NOT_FOUND, ErrorCodes::message(ErrorCodes::ERR_STAFF_NOT_FOUND), 404);
@@ -104,6 +108,7 @@ class StaffController extends BaseController
     public function toggle(string $uuid, #[CurrentUser] User $user): JsonResponse
     {
         $this->secretaryAccess->denyUnlessGranted($user, 'staff', 'update');
+        $this->clinicDoctorAccess->denyUnlessGranted($user, 'staff', 'update');
         $staff = $this->staffRepo->findByUuid($uuid);
         if ($staff === null) {
             return $this->error(ErrorCodes::ERR_STAFF_NOT_FOUND, ErrorCodes::message(ErrorCodes::ERR_STAFF_NOT_FOUND), 404);
@@ -122,6 +127,10 @@ class StaffController extends BaseController
     private function resolveEntity(User $user): array
     {
         if ($user->hasRole('ROLE_DOCTOR')) {
+            $memberClinicId = $this->clinicDoctorAccess->memberClinicId($user);
+            if ($memberClinicId !== null) {
+                return ['clinic', $memberClinicId];
+            }
             $doctor = $this->doctorRepo->findByUser($user);
             return $doctor !== null ? ['doctor', $doctor->getId()] : ['doctor', null];
         }