fix(crm): honor open data scopes and role assignees

Unset sections on a saved role policy were still filtered as own-only, so full lead access showed nothing. Activities can now be assigned by org role, and the Tahesab sales report reads as a result instead of a tag wall.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/views/TeamSettingsView.vue

@@ -11,6 +11,7 @@ import { useAuthStore } from '@/stores/auth';
 import UiIcon from '@/components/UiIcon.vue';
 import { UiDropdownMenu, UiModal } from '@/components/ui';
 import {
+  DATA_ACCESS_SECTIONS,
   ROLE_PERMISSION_ITEMS,
   type DataAccessPolicy,
   type InviteUserRequest,
@@ -734,6 +735,14 @@ function clonePolicy(policy?: DataAccessPolicy | null): DataAccessPolicy {
   return out;
 }
 
+function withOpenSections(policy: DataAccessPolicy): DataAccessPolicy {
+  const out = clonePolicy(policy);
+  for (const key of DATA_ACCESS_SECTIONS) {
+    if (!out[key]) out[key] = { mode: 'all', rules: [] };
+  }
+  return out;
+}
+
 function syncFocusDataAccess() {
   focusDataAccess.value = clonePolicy(accessFocusRole.value?.dataAccessPolicy);
 }
@@ -744,7 +753,9 @@ async function saveFocusDataAccess() {
   accessSaving.value = true;
   error.value = '';
   try {
-    await api.patch(`/org-roles/${role.id}`, { dataAccessPolicy: focusDataAccess.value });
+    const dataAccessPolicy = withOpenSections(focusDataAccess.value);
+    focusDataAccess.value = dataAccessPolicy;
+    await api.patch(`/org-roles/${role.id}`, { dataAccessPolicy });
     ok.value = `محدوده داده برای نقش «${role.name}» ذخیره شد.`;
     await load();
     syncFocusDataAccess();