feat(roles): let each section decide who may assign work to others

Section access now only creates a record for yourself. Assigning it to a colleague requires a separate permission on that section.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/leads/leads.controller.ts

@@ -302,8 +302,6 @@ export class LeadsController {
   }
 
   @Post('assign')
-  @UseGuards(RolesGuard)
-  @Roles('owner', 'admin')
   assign(@CurrentUser() user: Actor, @Body() dto: AssignLeadsDto) {
     return this.leads
       .assign(user, dto.leadIds, dto.assigneeId)