feat(roles): let each section decide who may assign work to others

Section access now only creates a record for yourself. Assigning it to a colleague requires a separate permission on that section.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/lib/assign-access.ts

@@ -0,0 +1,20 @@
+import {
+  ASSIGN_SECTION_PERMISSION,
+  type AssignSection,
+  type RolePermissionKey,
+} from '@mento/shared';
+
+export function canAssignToOthers(
+  user:
+    | {
+        role?: string | null;
+        permissions?: Array<RolePermissionKey | string> | null;
+      }
+    | null
+    | undefined,
+  section: AssignSection,
+): boolean {
+  if (!user) return false;
+  if (user.role === 'owner' || user.role === 'admin') return true;
+  return (user.permissions ?? []).includes(ASSIGN_SECTION_PERMISSION[section]);
+}