feat(plating-menu): Layer 1+2 — explicit groups on top-level menus + submenus

Phase D Tasks D1-D4 of permissions overhaul. Adds explicit groups=
attributes to:
- 9 top-level Plating menus (matrix per spec Section 2.E)
- Quality submenus: Audits, Customer Specs, AVL → QM-only
- Compliance hub child submenus (CGP, General, Safety, Aerospace,
  Nuclear) → QM-only
- Operations submenus: Maintenance, Move Log, Labor History → Shop
  Manager+; Replenishment Suggestions → Manager+

Replaces fragile inheritance + action-ACL-based visibility with
explicit per-menu gates. Now every role's menu tree is deterministic.

Also adds fusion_plating/tests/test_menu_visibility.py — per-role
matrix tests using ir.ui.menu.search_count with the test user.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fusion_plating/fusion_plating_nuclear/__manifest__.py

@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Nuclear (CSA N299, NQA-1)',
-    'version': '19.0.1.2.1',
+    'version': '19.0.1.2.2',
     'category': 'Manufacturing/Plating',
     'summary': 'Nuclear industry pack: CSA N299 Levels 1-4, NQA-1 awareness, '
                'CNSC licence tracking, 10 CFR Part 21 reporting, ITPs, '

fusion_plating/fusion_plating_nuclear/views/fp_menu.xml

@@ -7,11 +7,12 @@
 <odoo>
 
     <!-- Phase 1 — re-parented under Plating → Compliance hub. -->
+    <!-- Phase D (perms v2) — QM-only under compliance hub. -->
     <menuitem id="menu_fp_nuclear"
               name="Nuclear (CSA N299 / CNSC)"
               parent="fusion_plating.menu_fp_compliance_hub"
               sequence="40"
-              groups="fusion_plating.group_fusion_plating_operator"/>
+              groups="fusion_plating.group_fp_quality_manager"/>
 
     <menuitem id="menu_fp_nuclear_program"
               name="N299 Programs"