feat(acl): deep data access by section for roles and users

Role default + user override with OR rules; covers customers, leads, sales, activities, notes, routines, projects, and tickets.

apps/api/src/users/users.controller.ts

@@ -20,6 +20,7 @@ import {
   UpdateLogoutTimeDto,
   UpdateUserRoleDto,
   UpdateUserStatusDto,
+  UpdateUserDataAccessDto,
   UpdateUserVisibilityDto,
 } from './dto';
 import { UsersService } from './users.service';
@@ -143,6 +144,21 @@ export class UsersController {
     );
   }
 
+  @Patch(':id/data-access')
+  @Roles('owner', 'admin')
+  updateDataAccess(
+    @CurrentUser() user: { organizationId: string; role: UserRole },
+    @Param('id') id: string,
+    @Body() dto: UpdateUserDataAccessDto,
+  ) {
+    return this.usersService.updateDataAccess(
+      user.organizationId,
+      user.role,
+      id,
+      dto,
+    );
+  }
+
   @Patch(':id/role')
   @Roles('owner', 'admin')
   updateRole(