Implement Care RBAC role→permission→app matrix.

Replace broad doctor/nurse specialty access with granular roles and primary
apps, permission inheritance for lab/BB managers, and cannot-rules for
discharge, lab approve, and cashier vs billing officer.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Care/EmergencyWorkspaceController.php

@@ -128,7 +128,7 @@ class EmergencyWorkspaceController extends Controller
         SpecialtyVisitStageService $stages,
         EmergencyWorkflowService $workflow,
     ): RedirectResponse {
-        $this->authorizeAbility($request, 'consultations.manage');
+        $this->authorizeAbility($request, 'emergency.discharge');
         $this->assertEmergencyManage($request, $modules);
         $this->assertVisit($request, $visit);