feat: enforce role section permissions and add a leads permission

Unticking a section hides it from the menu, closes its routes and blocks its writes on the server; existing roles keep their current access via migration.

apps/api/src/invoices/invoices.controller.ts

@@ -10,6 +10,7 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { RequirePermission, SectionPermissionGuard } from '../auth/section-permission.guard';
 import { CurrentUser } from '../auth/current-user.decorator';
 import {
   CreateInvoiceDto,
@@ -22,7 +23,8 @@ import { InvoicesService } from './invoices.service';
 type AuthUser = { organizationId: string; userId: string; role: string };
 
 @Controller('invoices')
-@UseGuards(JwtAuthGuard)
+@UseGuards(JwtAuthGuard, SectionPermissionGuard)
+@RequirePermission('billing')
 export class InvoicesController {
   constructor(private readonly invoicesService: InvoicesService) {}