feat(acl): deep data access by section for roles and users

Role default + user override with OR rules; covers customers, leads, sales, activities, notes, routines, projects, and tickets.

apps/api/src/users/dto.ts

@@ -112,3 +112,14 @@ export class UpdateUserVisibilityDto {
   @IsObject()
   scopes?: Record<string, 'own' | 'team' | 'org' | null>;
 }
+
+export class UpdateUserDataAccessDto {
+  /**
+   * null = پاک کردن override و ارث از نقش.
+   * آبجکت = جایگزینی کامل override.
+   */
+  @ValidateIf((_, v) => v !== null)
+  @IsOptional()
+  @IsObject()
+  dataAccessOverride?: Record<string, unknown> | null;
+}