feat(accounting): grant revenue-mapping permissions to chart-of-accounts roles

Whoever can read the chart of accounts can read where revenue lands; whoever
can change it can change the mapping. Without this the محاسب role sees the
Accounting menu but gets 403 on the revenue-mapping screen.

super_admin holds the '*' wildcard and needs no explicit grant.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

database/seeds/Phase_100_002_grant_revenue_mapping_permissions.php

+<?php
+declare(strict_types=1);
+
+/**
+ * Grant the revenue-mapping permissions to the roles that already administer the
+ * chart of accounts.
+ *
+ * Whoever can read the chart of accounts can read where revenue lands; whoever can
+ * change the chart of accounts can change the mapping. Without this the accountant
+ * role can see the menu item's parent but not the screen itself.
+ *
+ * super_admin holds the '*' wildcard and needs no explicit grant.
+ */
+return function (\App\Core\Database $db): void {
+
+    $grants = [
+        'accounting.coa.view'   => 'accounting.revenue_mapping.view',
+        'accounting.coa.manage' => 'accounting.revenue_mapping.manage',
+    ];
+
+    foreach ($grants as $sourceKey => $newKey) {
+        $roles = $db->select(
+            "SELECT DISTINCT role_id FROM role_permissions WHERE permission_key = ?",
+            [$sourceKey]
+        );
+
+        foreach ($roles as $row) {
+            $roleId = (int) $row['role_id'];
+
+            $exists = $db->selectOne(
+                "SELECT id FROM role_permissions WHERE role_id = ? AND permission_key = ?",
+                [$roleId, $newKey]
+            );
+            if ($exists) {
+                continue;
+            }
+
+            $db->insert('role_permissions', [
+                'role_id'        => $roleId,
+                'permission_key' => $newKey,
+                'granted_at'     => date('Y-m-d H:i:s'),
+            ]);
+        }
+    }
+};