feat(acl): deep data access by section for roles and users

Role default + user override with OR rules; covers customers, leads, sales, activities, notes, routines, projects, and tickets.

apps/api/src/ai/ai-ask.service.ts

@@ -9,6 +9,7 @@ import type {
   VoicePersonDraft,
 } from '@mento/shared';
 import { PrismaService } from '../prisma/prisma.service';
+import { leadsDeepWhere } from '../common/data-access';
 import {
   type Actor,
   assigneeWhere,
@@ -260,6 +261,9 @@ Rules:
   }
 
   private leadWhere(actor: Actor) {
+    if (actor.leadsAccess !== undefined) {
+      return leadsDeepWhere(actor);
+    }
     const scoped = forScope(actor, 'leads');
     if (elevated(scoped.role) || scoped.dataVisibility === 'org') return {};
     if (scoped.dataVisibility === 'team' && scoped.visibleUserIds?.length) {