feat: gate treasury as an org module and group money inputs

Link optional invoice and cheque settlements to cash accounts, and let superadmin enable the finance module per organization.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/components/treasury/TreasuryNav.vue

@@ -1,18 +1,26 @@
 <script setup lang="ts">
+import { computed } from 'vue';
 import { useRoute } from 'vue-router';
+import { useAuthStore } from '@/stores/auth';
 
 const route = useRoute();
-const links = [
+const auth = useAuthStore();
+const canPayroll = computed(() =>
+  auth.user?.role === 'owner'
+  || auth.user?.role === 'admin'
+  || Boolean(auth.user?.permissions?.includes('treasury_payroll')),
+);
+const links = computed(() => [
   { to: '/finance', label: 'داشبورد', exact: true },
   { to: '/finance/incomes', label: 'دریافت‌ها و درآمدها' },
   { to: '/finance/expenses', label: 'پرداخت‌ها و هزینه‌ها' },
   { to: '/finance/receivables', label: 'اقساط و مطالبات' },
   { to: '/finance/accounts', label: 'صندوق و حساب‌ها' },
-  { to: '/finance/payroll', label: 'حقوق' },
+  ...(canPayroll.value ? [{ to: '/finance/payroll', label: 'حقوق' }] : []),
   { to: '/finance/recurring', label: 'تکرارشونده' },
   { to: '/finance/reports', label: 'گزارش' },
   { to: '/finance/categories', label: 'دسته‌بندی‌ها' },
-];
+]);
 
 function on(path: string, exact?: boolean) {
   if (exact) return route.path === path;