Fix nurse onboarding redirects and specialty Documents 404s.

Resolve staff memberships by invite/demo email as well as public_id so nurses stay on their employer org; block staff from owner onboarding; keep Documents viewable with module access while upload stays manage-gated.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Care/OnboardingController.php

@@ -26,6 +26,10 @@ class OnboardingController extends Controller
             return redirect()->route('care.dashboard');
         }
 
+        if (! $this->organizations->canCompleteOnboarding($request->user())) {
+            abort(403, 'Your facility setup is incomplete. Ask an administrator to finish onboarding.');
+        }
+
         return view('care.onboarding.show', [
             'user' => $request->user(),
             'timezones' => timezone_identifiers_list(),
@@ -41,6 +45,10 @@ class OnboardingController extends Controller
             return redirect()->route('care.dashboard');
         }
 
+        if (! $this->organizations->canCompleteOnboarding($request->user())) {
+            abort(403, 'Your facility setup is incomplete. Ask an administrator to finish onboarding.');
+        }
+
         $categoryKeys = array_keys($this->workflows->categories());
         $templateKeys = array_keys($this->workflows->templates());