-- DentalCare v0.9.0.4
-- Authorization, Independent Approval, and Minimum-Necessary Patient Access
--
-- Runtime applies this migration idempotently through setup_apply_v0904().
-- It creates denied-access decision logging, seeds granular patient-data
-- permissions, applies explicit role grants/denials, and records the release
-- markers used by deterministic update reconciliation.
-- No patient, clinical, appointment, billing, staffing, or audit record is deleted.
