Keep Nursing Services hub off the regular nurse role.

Floor nurses keep clinical charting and My shifts but no longer
derive nursing.services.view, roster manage, or the Nursing /
Nursing Services admin nav. Ward lead roles (ed_nurse, midwife, …)
and admins are unchanged. Gate the nursing_services specialty
redirect the same way as the hub route.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/Feature/CareMyShiftsAndNavPermissionsTest.php

@@ -154,7 +154,7 @@ class CareMyShiftsAndNavPermissionsTest extends TestCase
             ->assertSee('Day shift');
     }
 
-    public function test_nurse_still_gets_nursing_services_access(): void
+    public function test_regular_nurse_cannot_access_nursing_services_hub(): void
     {
         $user = User::create([
             'public_id' => 'nurse-hub',
@@ -170,8 +170,10 @@ class CareMyShiftsAndNavPermissionsTest extends TestCase
         ]);
 
         $permissions = app(CarePermissions::class);
-        $this->assertTrue($permissions->can($member, 'nursing.services.view'));
-        $this->assertTrue($permissions->can($member, 'inpatient.placement.view'));
+        $this->assertFalse($permissions->can($member, 'nursing.services.view'));
+        $this->assertFalse($permissions->can($member, 'inpatient.placement.view'));
+        $this->assertFalse($permissions->can($member, 'nursing.roster.manage'));
+        $this->assertTrue($permissions->can($member, 'nursing.my_shifts.view'));
         $this->assertFalse($permissions->can($member, 'admin.departments.view'));
         $this->assertFalse($permissions->can($member, 'admin.departments.manage'));
 
@@ -193,13 +195,19 @@ class CareMyShiftsAndNavPermissionsTest extends TestCase
 
         $this->actingAs($user)
             ->get(route('care.nursing.services'))
-            ->assertOk();
+            ->assertForbidden();
+
+        $this->actingAs($user)
+            ->get(route('care.specialty.show', 'nursing_services'))
+            ->assertForbidden();
 
         $this->actingAs($user)
             ->get(route('care.dashboard'))
             ->assertOk()
             ->assertDontSee('>Care units<', false)
             ->assertDontSee('>Departments<', false)
-            ->assertSee('>Nursing Services<', false);
+            ->assertDontSee('>Nursing Services<', false)
+            ->assertDontSee('>Nursing<', false)
+            ->assertSee('My shifts', false);
     }
 }