feat: enforce role section permissions and add a leads permission

Unticking a section hides it from the menu, closes its routes and blocks its writes on the server; existing roles keep their current access via migration.

packages/shared/src/index.ts

@@ -419,7 +419,7 @@ export const DATA_SCOPE_LABELS: Record<DataScope, string> = {
   contacts: "مشتریان (اشخاص و شرکت‌ها)",
   deals: "معاملات و اهداف فروش",
   activities: "فعالیت‌ها و کارها",
-  leads: "سرنخ‌ها",
+  leads: "لیدها",
   finance: "فاکتور، پیش‌فاکتور و چک",
   tickets: "تیکت‌ها",
   notes: "یادداشت‌ها",
@@ -438,6 +438,7 @@ export interface UpdateUserVisibilityRequest {
 
 export type RolePermissionKey =
   | "customers"
+  | "leads"
   | "sales"
   | "billing"
   | "products"
@@ -456,6 +457,7 @@ export const ROLE_PERMISSION_ITEMS: Array<{
   label: string;
 }> = [
   { key: "customers", label: "مشتریان" },
+  { key: "leads", label: "لیدها" },
   { key: "sales", label: "فروش و معاملات" },
   { key: "billing", label: "پیش‌فاکتورها و فاکتورها" },
   { key: "products", label: "محصولات و خدمات" },