feat: enforce role section permissions and add a leads permission

Unticking a section hides it from the menu, closes its routes and blocks its writes on the server; existing roles keep their current access via migration.

apps/api/src/pipelines/deals.controller.ts

@@ -16,6 +16,7 @@ import { FileInterceptor } from '@nestjs/platform-express';
 import { memoryStorage } from 'multer';
 import type { Response } from 'express';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { RequirePermission, SectionPermissionGuard } from '../auth/section-permission.guard';
 import { CurrentUser } from '../auth/current-user.decorator';
 import type { Actor } from '../common/record-scope';
 import { OrgModuleGuard } from '../billing/org-module.guard';
@@ -26,8 +27,9 @@ import { DealsExcelService } from './deals-excel.service';
 import { brand } from '@mento/shared';
 
 @Controller('deals')
-@UseGuards(JwtAuthGuard, OrgModuleGuard)
+@UseGuards(JwtAuthGuard, OrgModuleGuard, SectionPermissionGuard)
 @RequireOrgModule('pipeline')
+@RequirePermission('sales')
 export class DealsController {
   constructor(
     private readonly dealsService: DealsService,

apps/api/src/pipelines/pipelines.controller.ts

@@ -10,6 +10,7 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { RequirePermission, SectionPermissionGuard } from '../auth/section-permission.guard';
 import { CurrentUser } from '../auth/current-user.decorator';
 import { Roles } from '../auth/roles.decorator';
 import { RolesGuard } from '../auth/roles.guard';
@@ -24,7 +25,8 @@ import {
 import { PipelinesService } from './pipelines.service';
 
 @Controller('pipelines')
-@UseGuards(JwtAuthGuard, RolesGuard)
+@UseGuards(JwtAuthGuard, RolesGuard, SectionPermissionGuard)
+@RequirePermission('sales')
 export class PipelinesController {
   constructor(private readonly pipelinesService: PipelinesService) {}