Gate specialty modules by staff role with view and refer levels.

Give nurses, lab techs, pharmacists, and GPs broad access to day-to-day modules, keep restricted specialties for specialists (with support nurses), and let GPs view results or refer without full clinical edit.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/Feature/CareSpecialtyModulesTest.php

@@ -231,14 +231,14 @@ class CareSpecialtyModulesTest extends TestCase
 
         $this->actingAs($this->owner)
             ->get(route('care.specialty.show', 'dentistry'))
-            ->assertForbidden();
+            ->assertRedirect(route('care.queue.index'));
 
         $this->actingAs($nurse)
             ->get(route('care.specialty.show', 'dentistry'))
             ->assertRedirect(route('care.queue.index'));
     }
 
-    public function test_unassigned_doctor_cannot_open_specialty_module(): void
+    public function test_unassigned_gp_can_open_limited_specialty_module(): void
     {
         Http::fake();
         app(SpecialtyModuleService::class)->activate($this->organization, $this->owner->public_id, 'dentistry');
@@ -258,7 +258,7 @@ class CareSpecialtyModulesTest extends TestCase
 
         $this->actingAs($doctor)
             ->get(route('care.specialty.show', 'dentistry'))
-            ->assertForbidden();
+            ->assertRedirect(route('care.queue.index'));
     }
 
     public function test_assigned_specialty_doctor_can_open_module(): void
@@ -302,11 +302,20 @@ class CareSpecialtyModulesTest extends TestCase
                 'dentistry',
             ),
         );
+        // Restricted modules stay off for GPs without specialty assignment.
         $this->assertFalse(
-            app(SpecialtyModuleService::class)->memberCanAccess(
+            app(SpecialtyModuleService::class)->memberCanManage(
                 $this->organization->fresh(),
                 $member,
-                'maternity',
+                'cardiology',
+            ),
+        );
+        app(SpecialtyModuleService::class)->activate($this->organization->fresh(), $this->owner->public_id, 'cardiology');
+        $this->assertTrue(
+            app(SpecialtyModuleService::class)->memberCanRefer(
+                $this->organization->fresh(),
+                $member,
+                'cardiology',
             ),
         );
     }
@@ -348,7 +357,7 @@ class CareSpecialtyModulesTest extends TestCase
 
         $this->actingAs($this->owner)
             ->get(route('care.specialty.show', 'emergency'))
-            ->assertForbidden();
+            ->assertRedirect(route('care.queue.index'));
 
         $this->actingAs($nurse)
             ->get(route('care.specialty.show', 'emergency'))