Implement Care RBAC role→permission→app matrix.

Replace broad doctor/nurse specialty access with granular roles and primary
apps, permission inheritance for lab/BB managers, and cannot-rules for
discharge, lab approve, and cashier vs billing officer.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Services/Care/CareQueueBridge.php

@@ -820,7 +820,7 @@ class CareQueueBridge
                         fn ($p) => ($p['kind'] ?? '') === 'practitioner' && (int) ($p['ref_id'] ?? 0) === $practitionerId
                     );
             }
-            if ($member && $member->role === 'doctor') {
+            if ($member && app(CarePermissions::class)->usesPractitionerBranchScope($member)) {
                 $prac = Practitioner::owned($organization->owner_ref)
                     ->where('organization_id', $organization->id)
                     ->where('branch_id', $branchId)