feat(acl): deep data access by section for roles and users

Role default + user override with OR rules; covers customers, leads, sales, activities, notes, routines, projects, and tickets.

apps/api/prisma/migrations/20261022120000_deep_data_access/migration.sql

@@ -0,0 +1,27 @@
+-- Deep data access: role default + membership override (phase 1: customers)
+
+ALTER TABLE "OrgRole" ADD COLUMN IF NOT EXISTS "dataAccessPolicy" JSONB NOT NULL DEFAULT '{}';
+
+ALTER TABLE "Membership" ADD COLUMN IF NOT EXISTS "dataAccessOverride" JSONB NOT NULL DEFAULT '{}';
+
+-- Migrate legacy own/team/org (+ optional contacts scope) into customers override
+UPDATE "Membership" m
+SET "dataAccessOverride" = jsonb_build_object(
+  'customers',
+  CASE
+    WHEN COALESCE(
+      NULLIF(m."dataVisibilityScopes"::jsonb ->> 'contacts', ''),
+      m."dataVisibility"
+    ) = 'org' THEN '{"mode":"all","rules":[]}'::jsonb
+    WHEN COALESCE(
+      NULLIF(m."dataVisibilityScopes"::jsonb ->> 'contacts', ''),
+      m."dataVisibility"
+    ) = 'team' THEN '{"mode":"rules","rules":[{"owners":["self","team"]}]}'::jsonb
+    ELSE '{"mode":"rules","rules":[{"owners":["self"]}]}'::jsonb
+  END
+)
+WHERE m."role" NOT IN ('owner', 'admin')
+  AND (
+    m."dataAccessOverride" IS NULL
+    OR m."dataAccessOverride"::text IN ('{}', 'null')
+  );