feat: implement per-role WO visibility via getEloquentQuery

Admin/owner and users with work_orders.view_all see all work orders.
Users with only work_orders.view_own_assigned (mechanics) see only
work orders where master_id = their own user ID.
Roles without either permission see nothing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Filament/Tenant/Resources/WorkOrderResource.php

@@ -11,6 +11,7 @@ use App\Models\Tenant\WorkOrder;
 use App\Tenancy\TenantManager;
 use Filament\Actions;
 use Filament\Forms;
+use Illuminate\Database\Eloquent\Builder;
 use Filament\Resources\Resource;
 use Filament\Schemas;
 use Filament\Schemas\Components\Utilities\Get;
@@ -244,4 +245,25 @@ class WorkOrderResource extends Resource
             'edit' => Pages\EditWorkOrder::route('/{record}/edit'),
         ];
     }
+
+    /**
+     * Apply per-user visibility based on the permissions matrix:
+     *   admin/owner        → all work orders
+     *   work_orders.view_all → all work orders
+     *   view_own_assigned only → only WOs where master_id = current user
+     */
+    public static function getEloquentQuery(): Builder
+    {
+        $query = parent::getEloquentQuery();
+        $user  = auth()->user();
+
+        if (! $user) return $query->whereRaw('0 = 1');
+        if ($user->isAdmin()) return $query;
+        if ($user->canDo(\App\Auth\Permissions::WORK_ORDERS_VIEW_ALL)) return $query;
+        if ($user->canDo(\App\Auth\Permissions::WORK_ORDERS_VIEW_OWN_ASSIGNED)) {
+            return $query->where('master_id', $user->id);
+        }
+
+        return $query->whereRaw('0 = 1');
+    }
 }