Remove Care cashier access to Ladill POS.

Cashiers collect via Billing only; strip POS from demo staff grants and StaffUx/launcher so the suite hub no longer offers POS for that role.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Services/Care/CarePermissions.php

@@ -47,6 +47,8 @@ class CarePermissions
             'pharmacy.view', 'pharmacy.manage',
             'service_queues.console',
         ],
+        // Cashiers run the Billing desk (bills / payments). They do not get
+        // Ladill POS app access — see filterAllowedAppSlugs() / DemoWorld.
         'cashier' => [
             'dashboard.view', 'patients.view', 'bills.view', 'bills.manage', 'payments.manage',
             'service_queues.console',
@@ -120,4 +122,47 @@ class CarePermissions
     {
         return $member !== null && $member->role === 'doctor';
     }
+
+    /**
+     * Care cashiers collect via Billing, not Ladill POS. Strip POS from
+     * Identity app grants so the suite launcher hides it.
+     *
+     * @param  list<string>|null  $slugs  Null = unrestricted owner access.
+     * @return list<string>|null
+     */
+    public function filterAllowedAppSlugs(?Member $member, ?array $slugs): ?array
+    {
+        if ($slugs === null || $member?->role !== 'cashier') {
+            return $slugs;
+        }
+
+        return array_values(array_filter(
+            array_map('strval', $slugs),
+            fn (string $slug) => $slug !== 'pos',
+        ));
+    }
+
+    /**
+     * @param  array{full_access?: bool, apps?: list<string>, show_hub?: bool, show_billing?: bool}  $access
+     * @return array{full_access?: bool, apps?: list<string>, show_hub?: bool, show_billing?: bool}
+     */
+    public function filterStaffAppAccess(?Member $member, array $access): array
+    {
+        if ($member?->role !== 'cashier') {
+            return $access;
+        }
+
+        $apps = $this->filterAllowedAppSlugs($member, array_values(array_map(
+            'strval',
+            (array) ($access['apps'] ?? []),
+        ))) ?? [];
+
+        $access['apps'] = $apps;
+
+        if (empty($access['full_access']) && count($apps) <= 1) {
+            $access['show_hub'] = false;
+        }
+
+        return $access;
+    }
 }