feat: enforce role section permissions and add a leads permission

Unticking a section hides it from the menu, closes its routes and blocks its writes on the server; existing roles keep their current access via migration.

apps/api/src/audit-logs/audit-logs.controller.ts

@@ -5,6 +5,7 @@ import { JwtAuthGuard } from '../auth/jwt-auth.guard';
 import { CurrentUser } from '../auth/current-user.decorator';
 import { Roles } from '../auth/roles.decorator';
 import { RolesGuard } from '../auth/roles.guard';
+import { RequirePermission, SectionPermissionGuard } from '../auth/section-permission.guard';
 import { OrgModuleGuard } from '../billing/org-module.guard';
 import { RequireOrgModule } from '../billing/org-module.decorator';
 import { AuditLogsService } from './audit-logs.service';
@@ -42,9 +43,9 @@ class ListAuditQueryDto {
 }
 
 @Controller('audit-logs')
-@UseGuards(JwtAuthGuard, RolesGuard, OrgModuleGuard)
+@UseGuards(JwtAuthGuard, RolesGuard, OrgModuleGuard, SectionPermissionGuard)
 @RequireOrgModule('audit_logs')
-@Roles('owner', 'admin')
+@RequirePermission('audit', { reads: true })
 export class AuditLogsController {
   constructor(
     private readonly auditLogs: AuditLogsService,
@@ -52,6 +53,7 @@ export class AuditLogsController {
   ) {}
 
   @Get('attendance')
+  @Roles('owner', 'admin')
   attendanceList(
     @CurrentUser() user: { organizationId: string },
     @Query() query: ListAuditQueryDto,