fix(access): honor finance sections and team-member data scope

Role treasury keys now open the first allowed finance page, and team-member ownership limits lists, dashboard, and reports instead of the whole organization.

Co-authored-by: Cursor <cursoragent@cursor.com>

packages/shared/src/index.ts

@@ -636,6 +636,22 @@ export function parseUserTreasuryAccess(raw: unknown): UserTreasuryAccess | null
   };
 }
 
+/**
+ * دسترسی مالی کاربر، اگر تنظیم شده باشد، کلیدهای مالی نقش را جایگزین می‌کند.
+ * null یعنی همان مجوزهای نقش.
+ */
+export function permissionsWithTreasuryOverride(
+  rolePermissions: readonly string[],
+  override: UserTreasuryAccess | null,
+): string[] {
+  if (!override) return [...rolePermissions];
+  const rest = rolePermissions.filter(
+    (key) => key !== "treasury" && !key.startsWith("treasury_"),
+  );
+  if (!override.enabled) return rest;
+  return ["treasury", ...override.sections, ...rest];
+}
+
 export function emptySectionDataAccess(): SectionDataAccess {
   return { mode: "all", rules: [] };
 }