- Add branch_id accessor to User model (resolves from role_user pivot)
- Create AppliesRoleScope trait for one-liner scope enforcement
- Enhance PermissionService: include head_trainer_id in group lookup,
  add training_programs and invoices table support for own_groups scope
- Apply AppliesRoleScope to 16 list components:
  ParticipantList, GroupList, EnrollmentList, AttendanceList,
  InvoiceList, ProgramList, EvaluationList, CashSessionList,
  WalletList, AssignmentList, PersonList, FacilityList,
  ProductList, PurchaseOrderList, KitList, StockCountList

Now trainers only see their assigned groups/participants,
branch managers only see their branch data, parents only
see their children, and receptionists are branch-scoped.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>