fix(crm): honor open data scopes and role assignees

Unset sections on a saved role policy were still filtered as own-only, so full lead access showed nothing. Activities can now be assigned by org role, and the Tahesab sales report reads as a result instead of a tag wall.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/lib/tahesab.ts

@@ -14,16 +14,14 @@ export const TAHSAB_SANAD_LABELS: Record<string, string> = {
  * منفی → قدرمطلق + «بد» (بدهکار)، مثبت → قدرمطلق + «بس» (بستانکار).
  * صفر بدون پسوند.
  */
-export function formatTahesabBedBes(v: unknown): string {
+export function formatTahesabBedBes(v: unknown, maximumFractionDigits = 3): string {
   if (v == null) return '—';
   const s = String(v).trim();
   if (!s || s === 'null' || s === 'undefined' || s === 'NaN') return '—';
   const n = Number(s.replace(/,/g, ''));
   if (!Number.isFinite(n)) return toFaDigits(s);
   const abs = toFaDigits(
-    new Intl.NumberFormat('fa-IR', { maximumFractionDigits: 3 }).format(
-      Math.abs(n),
-    ),
+    new Intl.NumberFormat('fa-IR', { maximumFractionDigits }).format(Math.abs(n)),
   );
   if (n === 0) return abs;
   return `${abs} ${n < 0 ? 'بد' : 'بس'}`;