Add treasury document photos, table list, and manage permission.

Income/expense lists are table-or-card with detail, edit, void, and delete; edit/delete require owner, admin, or the new finance manage permission.

Co-authored-by: Cursor <cursoragent@cursor.com>

packages/shared/src/index.ts

@@ -892,6 +892,7 @@ export type RolePermissionKey =
   | "treasury_reports"
   | "treasury_audit"
   | "treasury_categories"
+  | "treasury_documents_manage"
   | "behavior";
 
 /** بخشی که مسئولش را می‌شود به کاربر دیگری داد */
@@ -947,6 +948,7 @@ export const ROLE_PERMISSION_ITEMS: Array<{
   { key: "treasury_reports", label: "مالی — گزارش" },
   { key: "treasury_audit", label: "مالی — سوابق" },
   { key: "treasury_categories", label: "مالی — دسته‌بندی" },
+  { key: "treasury_documents_manage", label: "مالی — ویرایش و حذف اسناد" },
   { key: "behavior", label: "شخصیت‌شناسی و دستیار فروش" },
 ];
 
@@ -990,6 +992,15 @@ export function treasurySectionAllowed(
   return perms.includes(section);
 }
 
+/** ویرایش/حذف اسناد مالی — مالک، مدیر، یا کلید اختصاصی در نقش/override */
+export function canManageTreasuryDocuments(
+  role: string | null | undefined,
+  permissions: readonly string[] | null | undefined,
+): boolean {
+  if (role === "owner" || role === "admin") return true;
+  return (permissions ?? []).includes("treasury_documents_manage");
+}
+
 export interface OrgRoleMemberDto {
   id: string;
   fullName: string;
@@ -6801,7 +6812,7 @@ export interface FinancialDocumentDto {
   reference: string | null;
   notes: string | null;
   createdAt: string;
-  attachments?: Array<{ id: string; fileName: string }>;
+  attachments?: Array<{ id: string; fileName: string; mimeType?: string }>;
 }
 
 export interface FinancialMovementDto {