-- Rol lab_readonly: dejar solo lab_domicilios y lab_ordenes (ambos con permiso read)
-- Eliminar módulos que no corresponden a este rol
DELETE FROM role_modules
WHERE role_id = (SELECT id FROM roles WHERE slug = 'lab_readonly')
  AND module_slug IN ('lab_dashboard', 'lab_pacientes');