Add peer review evidence export and restrict AQMM access

app/modules/aqmm_dashboard/service.py

@@ -68,11 +68,14 @@ def build_scope(db, request, user) -> AqmmScope:
 
 
 def can_view_aqmm_dashboard(db, user) -> bool:
+    """AQMM dashboard is intentionally restricted to Firm Admin and Partner roles.
+
+    Managers/staff may still complete assigned work and review actions through
+    Work Tracker, but the consolidated AQMM monitoring dashboard is a leadership
+    view and must not be exposed through broad service/client permissions.
+    """
     roles = set(get_user_roles(db, user.id))
-    permissions = set(get_user_permissions(db, user.id))
-    if roles.intersection({"System Admin", "Firm Admin", "Partner", "Manager", "Branch Manager"}):
-        return True
-    return bool(permissions.intersection({"services.view", "clients.view", "audit.view"}))
+    return bool(roles.intersection({"Firm Admin", "Partner"}))
 
 
 def _subscription_filters(scope: AqmmScope, financial_year: str = "", q: str = ""):

app/modules/aqmm_dashboard/templates/aqmm_dashboard/dashboard.html

@@ -7,6 +7,7 @@
       <p class="text-sm text-slate-500">Assurance engagement quality status, AQMM tasks, evidence, reviews and closure readiness.</p>
     </div>
     <div class="flex flex-wrap gap-2">
+      <a href="/peer-review/evidence?financial_year={{ financial_year or '' }}&q={{ q or '' }}" class="rounded-xl border border-slate-300 px-4 py-2 text-sm font-medium text-slate-700 hover:bg-slate-50">Peer Review Export</a>
       <a href="/aqmm/dashboard/export.csv?financial_year={{ financial_year or '' }}&q={{ q or '' }}" class="rounded-xl border border-slate-300 px-4 py-2 text-sm font-medium text-slate-700 hover:bg-slate-50">Export CSV</a>
       <a href="/services/engagements" class="rounded-xl bg-brand-600 px-4 py-2 text-sm font-medium text-white hover:bg-brand-700">Open Engagements</a>
     </div>