backend: add appointment/prescription/task RBAC resources

Extend the clinic access-control statements and role grants with
appointment/prescription/task resources (mirrored in the frontend client
AC), and widen the requirePermission type to accept any defined resource.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/lib/access.ts

@@ -7,11 +7,15 @@ import {
 } from "better-auth/plugins/organization/access";
 
 // RBAC for clinics (organizations). We extend Better Auth's default
-// organization statements (organization / member / invitation / team) with a
-// `patient` resource so roles can be granted fine-grained access to records.
+// organization statements (organization / member / invitation / team) with
+// clinical resources (`patient`, `appointment`, `prescription`, `task`) so roles
+// can be granted fine-grained access to records.
 export const statements = {
   ...defaultStatements,
   patient: ["read", "write", "delete"],
+  appointment: ["read", "write", "delete"],
+  prescription: ["read", "write", "delete"],
+  task: ["read", "write", "delete"],
 } as const;
 
 export const ac = createAccessControl(statements);
@@ -21,26 +25,38 @@ export const ac = createAccessControl(statements);
 // and add a read-only `viewer`. In the UI these read as Owner / Admin /
 // Clinician (member) / Viewer.
 //
-// owner / admin: run the clinic AND have full access to patient records.
+// owner / admin: run the clinic AND have full access to clinical records.
 export const owner = ac.newRole({
   ...ownerAc.statements,
   patient: ["read", "write", "delete"],
+  appointment: ["read", "write", "delete"],
+  prescription: ["read", "write", "delete"],
+  task: ["read", "write", "delete"],
 });
 
 export const admin = ac.newRole({
   ...adminAc.statements,
   patient: ["read", "write", "delete"],
+  appointment: ["read", "write", "delete"],
+  prescription: ["read", "write", "delete"],
+  task: ["read", "write", "delete"],
 });
 
-// member (clinician): a regular member who can read and edit patient records.
+// member (clinician): a regular member who can read and edit clinical records.
 export const member = ac.newRole({
   ...memberAc.statements,
   patient: ["read", "write"],
+  appointment: ["read", "write", "delete"],
+  prescription: ["read", "write", "delete"],
+  task: ["read", "write", "delete"],
 });
 
-// viewer: read-only access to patient records.
+// viewer: read-only access to clinical records.
 export const viewer = ac.newRole({
   patient: ["read"],
+  appointment: ["read"],
+  prescription: ["read"],
+  task: ["read"],
 });
 
 export const roles = { owner, admin, member, viewer };