feat: enforce role section permissions and add a leads permission

Unticking a section hides it from the menu, closes its routes and blocks its writes on the server; existing roles keep their current access via migration.

apps/api/src/reports/reports.controller.ts

@@ -17,6 +17,7 @@ import {
   MaxLength,
 } from 'class-validator';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { RequirePermission, SectionPermissionGuard } from '../auth/section-permission.guard';
 import { CurrentUser } from '../auth/current-user.decorator';
 import type { Actor } from '../common/record-scope';
 import { SavedViewsService } from '../saved-views/saved-views.service';
@@ -52,7 +53,8 @@ class UpdateReportViewDto {
 }
 
 @Controller('reports')
-@UseGuards(JwtAuthGuard)
+@UseGuards(JwtAuthGuard, SectionPermissionGuard)
+@RequirePermission('reports', { reads: true })
 export class ReportsController {
   constructor(
     private readonly reportsService: ReportsService,
@@ -95,7 +97,9 @@ export class ReportsController {
     });
   }
 
+  /** داشبورد صفحهٔ خانه برای همه باز است */
   @Get('home')
+  @RequirePermission('reports', { reads: false })
   home(@CurrentUser() user: Actor) {
     return this.reportsService.home(user);
   }