DRY permission matrix tests with generator

[SebastianSchuetze]

We have near-identical permission matrix tests per collection (e.g., clinicGalleryMedia.permission.test.ts, clinicGalleryEntries.permission.test.ts). Let's introduce a tiny test generator to cut boilerplate while preserving matrix coverage.

Proposal:

• Add tests/unit/access-matrix/generatePermissionSuite.ts exporting makePermissionSuite(slug, collection, displayName?)
• Refactor per-collection tests to 2–3 lines that call makePermissionSuite
• Keep matrix-helpers usage and per-collection display names intact
• Ensure CI matrix:verify remains unaffected

Acceptance:

• Existing permission matrix tests pass unchanged
• No reduction in coverage; only code duplication reduced

Notes:

• This is a test-only refactor (no runtime changes)
• Can be rolled out incrementally: add generator, refactor a couple of suites first