feat(roles): let each section decide who may assign work to others

Section access now only creates a record for yourself. Assigning it to a colleague requires a separate permission on that section.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/components/routines/QuickTaskModal.vue

@@ -33,6 +33,7 @@ import {
   todayKey,
 } from '@/lib/routines';
 import { useAuthStore } from '@/stores/auth';
+import { canAssignToOthers } from '@/lib/assign-access';
 
 const { Text: ATypographyText } = Typography;
 
@@ -117,7 +118,7 @@ watch(
 
 const assignees = computed(() => {
   const c = ctx.value;
-  if (!c?.isManager) return [];
+  if (!c?.isManager || !canAssignToOthers(auth.user, 'routines')) return [];
   return c.users;
 });