feat(acl): deep data access by section for roles and users

Role default + user override with OR rules; covers customers, leads, sales, activities, notes, routines, projects, and tickets.

apps/api/src/sms-campaigns/sms-campaigns.service.ts

@@ -17,6 +17,7 @@ import { SMS_CAMPAIGN_CHUNK_SIZE } from '@mento/shared';
 import { PrismaService } from '../prisma/prisma.service';
 import { SmsGatewayService } from '../sms-billing/sms-gateway.service';
 import { renderSmsText } from '../common/sms-text';
+import { leadsDeepWhere } from '../common/data-access';
 import {
   type Actor,
   elevated,
@@ -28,6 +29,9 @@ import { OutboundSmsLogService } from '../outbound-sms/outbound-sms-log.service'
 import type { Prisma } from '@prisma/client';
 
 function leadAccessWhere(baseActor: Actor): Prisma.LeadWhereInput {
+  if (baseActor.leadsAccess !== undefined) {
+    return leadsDeepWhere(baseActor);
+  }
   const actor = forScope(baseActor, 'leads');
   if (elevated(actor.role)) return {};
   if (actor.dataVisibility === 'org') return {};