Restricted clients via hmis_restricted_records

[gigxz]

Merging this PR

• use the squash-merge strategy for PRs targeting main
• use a merge-commit or rebase strategy for PRs targeting staging and production

Description

Issue: https://github.com/open-path/Green-River/issues/9292

Adds HMIS restricted-client support: clients marked restricted are hidden unless the user has can_view_restricted_clients at an overlapping enrollment project. Uses a polymorphic hmis_restricted_records table (clients first; other types later).

• Permissions: can_view_restricted_clients, can_mark_clients_as_restricted
• SetClientRestricted mutation + Client.restricted / access fields
• Docs: docs/features/hmis-restricted-records.md

Still WIP: enrollment/household/merge-candidate leak paths, CE visibility, and frontend.

Type of change

New feature

Checklist before requesting review

• I performed a self-review of my code
• I ran the OP review skill
• I ran the code that is being changed under ideal conditions, and it doesn't fail
• If adding a new endpoint / exposing data in a new way, I have:
  • ensured the API can't leak data from other data sources
  • ensured this does not introduce N+1s
  • ensured permissions and visibility checks are performed in the right places
• Any major architectural changes are supported by an approved ADR (Architectural Decision Record)
• I updated the documentation (or not applicable)
• I added spec tests (or not applicable)
• I provided testing instructions in this PR or the related issue (or not applicable)