feat(acl): deep data access by section for roles and users

Role default + user override with OR rules; covers customers, leads, sales, activities, notes, routines, projects, and tickets.

apps/api/src/org-roles/dto.ts

@@ -3,6 +3,7 @@ import {
   ArrayUnique,
   IsArray,
   IsIn,
+  IsObject,
   IsOptional,
   IsString,
   MaxLength,
@@ -36,6 +37,10 @@ export class CreateOrgRoleDto {
   @IsIn(PERMISSION_KEYS, { each: true })
   permissions?: RolePermissionKey[];
 
+  @IsOptional()
+  @IsObject()
+  dataAccessPolicy?: Record<string, unknown>;
+
   @IsOptional()
   @ValidateIf((_, v) => v !== null)
   @IsString()
@@ -64,6 +69,10 @@ export class UpdateOrgRoleDto {
   @IsIn(PERMISSION_KEYS, { each: true })
   permissions?: RolePermissionKey[];
 
+  @IsOptional()
+  @IsObject()
+  dataAccessPolicy?: Record<string, unknown>;
+
   @IsOptional()
   @ValidateIf((_, v) => v !== null)
   @IsString()