fix(access): honor finance sections and team-member data scope

Role treasury keys now open the first allowed finance page, and team-member ownership limits lists, dashboard, and reports instead of the whole organization.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/router/index.ts

@@ -2,7 +2,12 @@ import { createRouter, createWebHistory } from 'vue-router';
 import type { UserRole } from '@mento/shared';
 import { useAuthStore } from '@/stores/auth';
 import { usePlatformAuthStore } from '@/stores/platform-auth';
-import { canOpenFinancePath, canOpenPath, sectionPermissionForPath } from '@/lib/section-permissions';
+import {
+  canOpenFinancePath,
+  canOpenPath,
+  firstAllowedFinancePath,
+  sectionPermissionForPath,
+} from '@/lib/section-permissions';
 
 export const router = createRouter({
   history: createWebHistory(),
@@ -683,13 +688,8 @@ router.beforeEach((to) => {
       if (canOpenFinancePath(auth.user?.role, auth.user?.permissions, String(to.path))) {
         return true;
       }
-      const exactHome = to.path === '/finance' || to.path === '/finance/';
-      if (
-        exactHome &&
-        canOpenFinancePath(auth.user?.role, auth.user?.permissions, '/finance/payroll')
-      ) {
-        return { path: '/finance/payroll' };
-      }
+      const next = firstAllowedFinancePath(auth.user?.role, auth.user?.permissions);
+      if (next && next !== to.path) return { path: next };
     }
     return { name: 'home' };
   }