Task #121: Hide Executive Meetings icon from non-executive users

Gate the home-screen "Executive Meetings" app icon behind a new
`executive_meetings.access` permission so only admins and the five
executive_* roles see it. Reuses the existing `app_permissions` →
`getVisibleAppsForUser` machinery; no route or middleware changes.

Changes
- scripts/src/seed.ts
  * Added permission `executive_meetings.access`.
  * Granted it to: admin, executive_ceo, executive_office_manager,
    executive_coord_lead, executive_coordinator, executive_viewer.
  * Linked it to apps.slug = 'executive-meetings' via app_permissions.
  * All inserts use onConflictDoNothing — re-running the seeder is safe.
- artifacts/api-server/scripts/gate-executive-meetings.mjs (new)
  * One-shot, idempotent pg migration that performs the same three
    inserts in a single transaction (BEGIN/ROLLBACK on error). Prints
    JSON summary with grant counts. Already executed against dev DB
    (newRoleGrantsThisRun=6, newAppLinksThisRun=1).
- artifacts/api-server/tests/executive-meetings-visibility.test.mjs (new)
  * Regression: creates a fresh `order_receiver`-only user, asserts
    /api/apps does NOT include `executive-meetings`; then grants
    `executive_coordinator` and asserts it does. Per-run username
    prefix + defensive sweep + after-hook cleanup.

Out of scope (not modified)
- artifacts/api-server/src/routes/apps.ts (getVisibleAppsForUser)
- artifacts/api-server/src/routes/executive-meetings.ts
  (requireExecutiveAccess)
- Any UI files

Verification
- `node artifacts/api-server/scripts/gate-executive-meetings.mjs` →
  ok=true, 6 role grants, 1 app link.
- `node --test tests/executive-meetings-visibility.test.mjs` →
  2/2 pass.
- TypeScript clean for scripts package.
- Architect review: PASS, no blocking issues.

artifacts/api-server/scripts/gate-executive-meetings.mjs

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+/**
+ * One-shot, idempotent migration for Task #121.
+ *
+ * Adds the `executive_meetings.access` permission, grants it to admin + all
+ * executive_* roles, and links it to the `executive-meetings` app via
+ * `app_permissions` so the home-screen icon is hidden from users who don't
+ * have an executive role.
+ *
+ * Safe to run multiple times — every insert uses ON CONFLICT DO NOTHING.
+ *
+ * Usage (from repo root):
+ *   DATABASE_URL=... node artifacts/api-server/scripts/gate-executive-meetings.mjs
+ */
+import pg from "pg";
+
+const DATABASE_URL = process.env.DATABASE_URL;
+if (!DATABASE_URL) {
+  console.error("DATABASE_URL must be set");
+  process.exit(1);
+}
+
+const pool = new pg.Pool({ connectionString: DATABASE_URL });
+
+const EXEC_ROLE_NAMES = [
+  "admin",
+  "executive_ceo",
+  "executive_office_manager",
+  "executive_coord_lead",
+  "executive_coordinator",
+  "executive_viewer",
+];
+
+async function main() {
+  const client = await pool.connect();
+  try {
+    await client.query("BEGIN");
+
+    // 1) Permission row.
+    await client.query(
+      `INSERT INTO permissions (name, description_ar, description_en)
+       VALUES ($1, $2, $3)
+       ON CONFLICT (name) DO NOTHING`,
+      [
+        "executive_meetings.access",
+        "الوصول إلى وحدة الاجتماعات التنفيذية",
+        "Access the Executive Meetings module",
+      ],
+    );
+
+    const permRes = await client.query(
+      `SELECT id FROM permissions WHERE name = $1`,
+      ["executive_meetings.access"],
+    );
+    if (permRes.rowCount === 0) {
+      throw new Error("Failed to find executive_meetings.access permission");
+    }
+    const permId = permRes.rows[0].id;
+
+    // 2) Role grants.
+    const grantRes = await client.query(
+      `INSERT INTO role_permissions (role_id, permission_id)
+       SELECT r.id, $1 FROM roles r WHERE r.name = ANY($2::text[])
+       ON CONFLICT DO NOTHING
+       RETURNING role_id`,
+      [permId, EXEC_ROLE_NAMES],
+    );
+
+    // 3) App link.
+    const appRes = await client.query(
+      `SELECT id FROM apps WHERE slug = $1`,
+      ["executive-meetings"],
+    );
+    if (appRes.rowCount === 0) {
+      throw new Error(
+        "executive-meetings app not found in the apps table; aborting",
+      );
+    }
+    const appId = appRes.rows[0].id;
+    const appLinkRes = await client.query(
+      `INSERT INTO app_permissions (app_id, permission_id)
+       VALUES ($1, $2)
+       ON CONFLICT DO NOTHING
+       RETURNING app_id`,
+      [appId, permId],
+    );
+
+    await client.query("COMMIT");
+
+    // Final state for the operator.
+    const totalGrants = await client.query(
+      `SELECT COUNT(*)::int AS c
+         FROM role_permissions rp
+         JOIN roles r ON r.id = rp.role_id
+        WHERE rp.permission_id = $1 AND r.name = ANY($2::text[])`,
+      [permId, EXEC_ROLE_NAMES],
+    );
+    const totalLinks = await client.query(
+      `SELECT COUNT(*)::int AS c
+         FROM app_permissions
+        WHERE permission_id = $1`,
+      [permId],
+    );
+
+    console.log(
+      JSON.stringify(
+        {
+          ok: true,
+          permissionId: permId,
+          executiveAppId: appId,
+          newRoleGrantsThisRun: grantRes.rowCount ?? 0,
+          newAppLinksThisRun: appLinkRes.rowCount ?? 0,
+          executiveRoleGrantsTotal: totalGrants.rows[0].c,
+          appPermissionLinksTotal: totalLinks.rows[0].c,
+        },
+        null,
+        2,
+      ),
+    );
+  } catch (err) {
+    await client.query("ROLLBACK").catch(() => {});
+    throw err;
+  } finally {
+    client.release();
+    await pool.end();
+  }
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});