Implement Care RBAC role→permission→app matrix.

Replace broad doctor/nurse specialty access with granular roles and primary
apps, permission inheritance for lab/BB managers, and cannot-rules for
discharge, lab approve, and cashier vs billing officer.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Services/Care/OrganizationResolver.php

@@ -282,7 +282,7 @@ class OrganizationResolver
             return null;
         }
 
-        if ($member->role === 'doctor') {
+        if (app(CarePermissions::class)->usesPractitionerBranchScope($member)) {
             return $this->doctorAssignedBranchIds($member);
         }
 
@@ -356,7 +356,7 @@ class OrganizationResolver
             return null;
         }
 
-        if ($member->role === 'doctor') {
+        if (app(CarePermissions::class)->usesPractitionerBranchScope($member)) {
             $ids = $this->doctorAssignedBranchIds($member);
             if ($ids === []) {
                 return 0;