fix(treasury): scope finance access and hide it when the module is off

Accounts can be edited, including the opening balance, and finance sections and accounts can be granted on a role or on one user. The finance menu stays hidden when the organization module is disabled.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/lib/section-permissions.ts

@@ -1,4 +1,9 @@
-import type { RolePermissionKey, UserRole } from '@mento/shared';
+import {
+  treasurySectionAllowed,
+  type RolePermissionKey,
+  type TreasurySectionKey,
+  type UserRole,
+} from '@mento/shared';
 
 /** مسیر صفحه ← مجوز بخش؛ هم‌تراز SectionPermissionGuard در API */
 const PATH_PERMISSIONS: Array<[prefix: string, key: RolePermissionKey]> = [
@@ -39,6 +44,31 @@ export function hasSectionPermission(
   return Boolean(permissions?.includes(key));
 }
 
+function financeSection(path: string): TreasurySectionKey | null {
+  const clean = path.split(/[?#]/)[0] ?? path;
+  if (!clean.startsWith('/finance')) return null;
+  if (clean.startsWith('/finance/payroll')) return 'treasury_payroll';
+  if (clean.startsWith('/finance/incomes')) return 'treasury_incomes';
+  if (clean.startsWith('/finance/expenses')) return 'treasury_expenses';
+  if (clean.startsWith('/finance/receivables')) return 'treasury_receivables';
+  if (clean.startsWith('/finance/accounts')) return 'treasury_accounts';
+  if (clean.startsWith('/finance/recurring')) return 'treasury_recurring';
+  if (clean.startsWith('/finance/reports')) return 'treasury_reports';
+  if (clean.startsWith('/finance/audit')) return 'treasury_audit';
+  if (clean.startsWith('/finance/categories')) return 'treasury_categories';
+  return 'treasury_dashboard';
+}
+
+export function canOpenFinancePath(
+  role: UserRole | string | null | undefined,
+  permissions: readonly string[] | null | undefined,
+  path: string,
+): boolean {
+  const section = financeSection(path);
+  if (!section) return true;
+  return treasurySectionAllowed(role, permissions, section);
+}
+
 export function canOpenPath(
   role: UserRole | string | null | undefined,
   permissions: readonly string[] | null | undefined,