fix(crm): honor open data scopes and role assignees

Unset sections on a saved role policy were still filtered as own-only, so full lead access showed nothing. Activities can now be assigned by org role, and the Tahesab sales report reads as a result instead of a tag wall.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/common/data-access.ts

@@ -62,6 +62,11 @@ export function resolveSectionAccess(
   if (rolePolicy[sectionKey]) {
     return { section: rolePolicy[sectionKey]!, source: 'role' };
   }
+  // فرم محدودهٔ نقش، بخشِ ننوشته را «بدون محدودیت» نشان می‌دهد.
+  // اگر نقش حتی یک بخش ذخیره کرده باشد، بقیه نباید به دید قدیمی own/team برگردند.
+  if (Object.keys(rolePolicy).length > 0) {
+    return { section: { mode: 'all', rules: [] }, source: 'role' };
+  }
   if (input.legacyVisibility != null || input.legacyScopes) {
     return {
       section: migrateVisibilityToSectionAccess(