Restrict employee access to orders and deliveries while fixing supplier visibility

Fixes bugs that prevented employees from viewing supplier lists and restricted their access to order and delivery creation functionalities.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: b163d4c0-de5e-4f4e-a9c0-aed4c7049718
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/1957c339-2757-4d1f-8e92-e9f71a1ce58e/b163d4c0-de5e-4f4e-a9c0-aed4c7049718/9RgkyCi

client/src/pages/Calendar.tsx

@@ -14,6 +14,7 @@ import { apiRequest } from "@/lib/queryClient";
 import { useToast } from "@/hooks/use-toast";
 import { format, startOfMonth, endOfMonth } from "date-fns";
 import { fr } from "date-fns/locale";
+import { hasPermission } from "@/lib/permissions";
 
 export default function Calendar() {
   const { user } = useAuthUnified();
@@ -250,14 +251,15 @@ export default function Calendar() {
             </Button>
           </div>
           <div className="flex items-center space-x-2">
-
-            <Button
-              onClick={() => setShowQuickCreate(true)}
-              className="bg-accent hover:bg-orange-600 text-white"
-            >
-              <Plus className="w-4 h-4 mr-2" />
-              Nouveau
-            </Button>
+            {(hasPermission(user?.role || '', 'orders', 'create') || hasPermission(user?.role || '', 'deliveries', 'create')) && (
+              <Button
+                onClick={() => setShowQuickCreate(true)}
+                className="bg-accent hover:bg-orange-600 text-white"
+              >
+                <Plus className="w-4 h-4 mr-2" />
+                Nouveau
+              </Button>
+            )}
           </div>
         </div>
       </div>