feat(roles): let each section decide who may assign work to others

Section access now only creates a record for yourself. Assigning it to a colleague requires a separate permission on that section.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/components/activities/ActivityFieldsEditor.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { ref, watch } from 'vue';
+import { computed, ref, watch } from 'vue';
 import type {
   ActivityChecklistItem,
   ActivityFieldDef,
@@ -11,6 +11,8 @@ import type {
   PersonDto,
 } from '@mento/shared';
 import { api } from '@/lib/api';
+import { canAssignToOthers } from '@/lib/assign-access';
+import { useAuthStore } from '@/stores/auth';
 import { toFaDigits } from '@/lib/jalali';
 import JalaliDateInput from '@/components/JalaliDateInput.vue';
 import UserMultiSelect from '@/components/UserMultiSelect.vue';
@@ -22,6 +24,8 @@ const props = defineProps<{
 }>();
 
 const model = defineModel<ActivityFieldValues>({ required: true });
+const auth = useAuthStore();
+const canAssignOthers = computed(() => canAssignToOthers(auth.user, 'activities'));
 
 function get<T extends ActivityFieldValue>(key: string, fallback: T): T {
   const v = model.value[key];
@@ -304,6 +308,7 @@ watch(
           <UserMultiSelect
             :model-value="participants(f.key).userIds"
             :users="users"
+            :disabled="!canAssignOthers"
             add-label="افزودن همکار"
             empty-label="همکاری انتخاب نشده"
             @update:model-value="(ids: string[]) => patchParticipants(f.key, { userIds: ids })"