Add viewer access to records and restrict activity log

- canView() + canViewAny() in EnforcesRoles: all SMS roles can view
- View pages for all 7 resources so viewers can open records read-only
- Custom ActivityResource restricts activity log to admin + manager only

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Traits/EnforcesRoles.php

@@ -6,6 +6,16 @@ use Illuminate\Database\Eloquent\Model;
 
 trait EnforcesRoles
 {
+    public static function canViewAny(): bool
+    {
+        return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager', 'sms-viewer']) ?? false;
+    }
+
+    public static function canView(Model $record): bool
+    {
+        return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager', 'sms-viewer']) ?? false;
+    }
+
     public static function canCreate(): bool
     {
         return auth()->user()?->hasAnyRole(['sms-admin', 'sms-manager']) ?? false;