fix(treasury): scope finance access and hide it when the module is off

Accounts can be edited, including the opening balance, and finance sections and accounts can be granted on a role or on one user. The finance menu stays hidden when the organization module is disabled.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/router/index.ts

@@ -2,7 +2,7 @@ import { createRouter, createWebHistory } from 'vue-router';
 import type { UserRole } from '@mento/shared';
 import { useAuthStore } from '@/stores/auth';
 import { usePlatformAuthStore } from '@/stores/platform-auth';
-import { canOpenPath, sectionPermissionForPath } from '@/lib/section-permissions';
+import { canOpenFinancePath, canOpenPath, sectionPermissionForPath } from '@/lib/section-permissions';
 
 export const router = createRouter({
   history: createWebHistory(),
@@ -330,7 +330,7 @@ export const router = createRouter({
               meta: {
                 roles: ['owner', 'admin'] as UserRole[],
                 treasuryTitle: 'حقوق و دستمزد',
-                treasuryDescription: 'فقط مالک و مدیر این صفحه را می‌بینند.',
+                treasuryDescription: 'پرداخت حقوق فقط با دسترسی جداگانه حقوق و دستمزد باز است.',
               },
             },
             {
@@ -678,10 +678,16 @@ router.beforeEach((to) => {
       return true;
     }
     if (String(to.path).startsWith('/finance')) {
-      const perms = auth.user?.permissions ?? [];
-      const payroll = to.path.startsWith('/finance/payroll');
-      if (payroll && perms.includes('treasury_payroll')) return true;
-      if (!payroll && (perms.includes('treasury') || perms.includes('treasury_payroll'))) return true;
+      if (canOpenFinancePath(auth.user?.role, auth.user?.permissions, String(to.path))) {
+        return true;
+      }
+      const exactHome = to.path === '/finance' || to.path === '/finance/';
+      if (
+        exactHome &&
+        canOpenFinancePath(auth.user?.role, auth.user?.permissions, '/finance/payroll')
+      ) {
+        return { path: '/finance/payroll' };
+      }
     }
     return { name: 'home' };
   }