Implement Care RBAC role→permission→app matrix.

Replace broad doctor/nurse specialty access with granular roles and primary
apps, permission inheritance for lab/BB managers, and cannot-rules for
discharge, lab approve, and cashier vs billing officer.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/Feature/CareLabTest.php

@@ -179,6 +179,13 @@ class CareLabTest extends TestCase
         $this->assertSame(InvestigationRequest::STATUS_AWAITING_REVIEW, $request->status);
         $this->assertTrue($request->result->is_abnormal);
 
+        // Lab techs enter results; approval requires pathology.result.approve (manager+).
+        $this->actingAs($this->user)
+            ->post(route('care.lab.requests.approve', $request))
+            ->assertForbidden();
+
+        Member::where('user_ref', $this->user->public_id)->update(['role' => 'lab_manager']);
+
         $this->actingAs($this->user)
             ->post(route('care.lab.requests.approve', $request))
             ->assertRedirect();