feat: enforce role section permissions and add a leads permission

Unticking a section hides it from the menu, closes its routes and blocks its writes on the server; existing roles keep their current access via migration.

apps/web/src/router/index.ts

@@ -2,6 +2,7 @@ import { createRouter, createWebHistory } from 'vue-router';
 import type { UserRole } from '@mento/shared';
 import { useAuthStore } from '@/stores/auth';
 import { usePlatformAuthStore } from '@/stores/platform-auth';
+import { canOpenPath, sectionPermissionForPath } from '@/lib/section-permissions';
 
 export const router = createRouter({
   history: createWebHistory(),
@@ -581,12 +582,19 @@ router.beforeEach((to) => {
     const modules = auth.user?.enabledModules;
     if (modules && !modules.includes('treasury')) return { name: 'home' };
   }
+  if (!canOpenPath(auth.user?.role, auth.user?.permissions, String(to.path))) {
+    return { name: 'home' };
+  }
   const roles = to.meta.roles as UserRole[] | undefined;
   if (roles?.length) {
     const role = auth.user?.role as UserRole | undefined;
     if (role && roles.includes(role)) {
       return true;
     }
+    // لاگ فعالیت: تیک «لاگ فعالیت کاربران» جایگزین نقش مدیر می‌شود
+    if (sectionPermissionForPath(String(to.path)) === 'audit') {
+      return true;
+    }
     if (to.name === 'team-settings' && auth.user?.viewAs?.canOpenTeamSettings) {
       return true;
     }