feat(acl): deep data access by section for roles and users

Role default + user override with OR rules; covers customers, leads, sales, activities, notes, routines, projects, and tickets.

apps/api/src/memberships/memberships.service.ts

@@ -98,7 +98,7 @@ export class MembershipsService {
       where: { organizationId, userId },
       include: {
         user: true,
-        orgRole: { select: { id: true, name: true, color: true } },
+        orgRole: { select: { id: true, name: true, color: true, dataAccessPolicy: true } },
       },
     });
   }
@@ -108,7 +108,7 @@ export class MembershipsService {
       where: { organizationId },
       include: {
         user: true,
-        orgRole: { select: { id: true, name: true, color: true } },
+        orgRole: { select: { id: true, name: true, color: true, dataAccessPolicy: true } },
       },
       orderBy: [{ user: { lastLoginAt: 'desc' } }, { user: { fullName: 'asc' } }],
     });