feat: enforce role section permissions and add a leads permission

Unticking a section hides it from the menu, closes its routes and blocks its writes on the server; existing roles keep their current access via migration.

apps/web/src/views/AuditLogsView.vue

@@ -64,6 +64,12 @@ const RETENTION_OPTIONS: Array<{ value: DeletionRetention; label: string }> = [
 const router = useRouter();
 const auth = useAuthStore();
 const isOwner = computed(() => auth.user?.role === 'owner');
+/** ورود و خروج فقط برای مالک و مدیر؛ بقیه با مجوز «لاگ فعالیت» فقط لاگ‌ها را می‌بینند */
+const visibleTabs = computed(() =>
+  auth.user?.role === 'owner' || auth.user?.role === 'admin'
+    ? TABS
+    : TABS.filter((item) => item.key !== 'attendance'),
+);
 
 const loading = ref(false);
 const savingRetention = ref(false);
@@ -366,7 +372,7 @@ onMounted(() => {
 
     <nav class="tabs" aria-label="نوع رویداد">
       <button
-        v-for="item in TABS"
+        v-for="item in visibleTabs"
         :key="item.key"
         type="button"
         :class="{ on: tab === item.key }"