fix(access): honor finance sections and team-member data scope

Role treasury keys now open the first allowed finance page, and team-member ownership limits lists, dashboard, and reports instead of the whole organization.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/lib/section-permissions.ts

@@ -69,6 +69,30 @@ export function canOpenFinancePath(
   return treasurySectionAllowed(role, permissions, section);
 }
 
+const FINANCE_ENTRIES: Array<{ path: string; section: TreasurySectionKey }> = [
+  { path: '/finance', section: 'treasury_dashboard' },
+  { path: '/finance/incomes', section: 'treasury_incomes' },
+  { path: '/finance/expenses', section: 'treasury_expenses' },
+  { path: '/finance/receivables', section: 'treasury_receivables' },
+  { path: '/finance/accounts', section: 'treasury_accounts' },
+  { path: '/finance/payroll', section: 'treasury_payroll' },
+  { path: '/finance/recurring', section: 'treasury_recurring' },
+  { path: '/finance/reports', section: 'treasury_reports' },
+  { path: '/finance/audit', section: 'treasury_audit' },
+  { path: '/finance/categories', section: 'treasury_categories' },
+];
+
+/** اولین صفحهٔ مالی که این نقش واقعاً می‌تواند باز کند. */
+export function firstAllowedFinancePath(
+  role: UserRole | string | null | undefined,
+  permissions: readonly string[] | null | undefined,
+): string | null {
+  for (const entry of FINANCE_ENTRIES) {
+    if (treasurySectionAllowed(role, permissions, entry.section)) return entry.path;
+  }
+  return null;
+}
+
 export function canOpenPath(
   role: UserRole | string | null | undefined,
   permissions: readonly string[] | null | undefined,