feat(management-level): scope reads to planning audience

packages/api/src/router/assistant.ts

@@ -230,6 +230,7 @@ const PLANNING_READ_TOOLS = new Set([
   "list_demands",
   "list_clients",
   "list_roles",
+  "list_management_levels",
   "list_utilization_categories",
   "check_resource_availability",
   "get_staffing_suggestions",

packages/api/src/router/management-level.ts

@@ -8,19 +8,19 @@ import { TRPCError } from "@trpc/server";
 import { z } from "zod";
 import { findUniqueOrThrow } from "../db/helpers.js";
 import { createAuditEntry } from "../lib/audit.js";
-import { adminProcedure, createTRPCRouter, protectedProcedure } from "../trpc.js";
+import { adminProcedure, createTRPCRouter, planningReadProcedure } from "../trpc.js";
 
 export const managementLevelRouter = createTRPCRouter({
   // ─── Groups ─────────────────────────────────────────────
 
-  listGroups: protectedProcedure.query(async ({ ctx }) => {
+  listGroups: planningReadProcedure.query(async ({ ctx }) => {
     return ctx.db.managementLevelGroup.findMany({
       include: { levels: { orderBy: { name: "asc" } } },
       orderBy: { sortOrder: "asc" },
     });
   }),
 
-  getGroupById: protectedProcedure
+  getGroupById: planningReadProcedure
     .input(z.object({ id: z.string() }))
     .query(async ({ ctx, input }) => {
       const group = await findUniqueOrThrow(