Implement Care RBAC role→permission→app matrix.

Replace broad doctor/nurse specialty access with granular roles and primary
apps, permission inheritance for lab/BB managers, and cannot-rules for
discharge, lab approve, and cashier vs billing officer.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Care/InvestigationController.php

@@ -228,7 +228,7 @@ class InvestigationController extends Controller
 
     public function approve(Request $request, InvestigationRequest $investigation): RedirectResponse
     {
-        $this->authorizeAbility($request, 'lab.manage');
+        $this->authorizeAbility($request, 'pathology.result.approve');
         $this->authorizeInvestigation($request, $investigation);
 
         $this->investigations->approve($investigation, $this->ownerRef($request), $this->ownerRef($request));