UnifiedAnalyticsService._filter_by_role tried queryset.filter(department=...) on
SurveyInstance which has no department FK → FieldError → 500 for dept_manager
and director users accessing the command center.
Fixed: check if the model actually has a department field before filtering;
fall back to hospital-level filtering for models without department.
Also: RBAC matrix test updated with more accurate state-based detection.
Comprehensive role × action permission matrix test. Key findings:
1. source_user: 0/20 blocks — ALL main app views accessible (should be restricted)
2. config_dashboard: accessible by ALL roles (should be px_admin only)
3. Many POST actions return 302 (redirect with error) instead of 403 when
blocked — the action is actually denied but HTTP status looks like success.
This is a design pattern (catch PermissionDenied → redirect with message).
4. physician/nurse/staff/viewer can reach complaint_change_status, inquiry_respond,
observation_change_status, action_create, project_create — these may be real
gaps OR the 302-redirect pattern (need state-based verification).
The test surfaces both real RBAC gaps and areas where the redirect-instead-of-403
pattern makes HTTP-status-based detection unreliable.
