feat(auth): gate and regate freight API controllers

Gates the previously open support-agent, procurement, compliance,
facilities, list-users and trade-access controllers, separates customer
from staff routes across bookings, contracts, companies, billing,
warehouses, files and train scheduling, and moves billing, overview,
reports and the settings controllers onto their own keys instead of the
blanket admin key. Drops the demo-permissions module and the untested
notification test route.

apps/edr-freight-api/src/modules/exchange-settings/exchange-settings.controller.ts

@@ -3,7 +3,8 @@ import { ApiBearerAuth, ApiOperation, ApiTags } from "@nestjs/swagger";
 import { CurrentUser } from "@edr/api-common";
 import type { TCurrentUser } from "@tria-plc/api-common/modules/auth/types/current-user.type";
 
-import { FreightAdmin } from "../../common/booking-guards";
+import { BookingStaff } from "../../common/booking-guards";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { UpdateExchangeSettingDto } from "./dto/update-exchange-setting.dto";
 import { ExchangeSettingsService } from "./exchange-settings.service";
 
@@ -14,7 +15,7 @@ export class ExchangeSettingsController {
   constructor(private readonly service: ExchangeSettingsService) {}
 
   @Get()
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.exchangeRate.view, FREIGHT_PERMS.admin])
   @ApiOperation({
     summary: "Current USD→ETB fallback rate and CBE feed health",
   })
@@ -32,7 +33,7 @@ export class ExchangeSettingsController {
   }
 
   @Patch()
-  @FreightAdmin()
+  @BookingStaff([FREIGHT_PERMS.settings.exchangeRate.manage, FREIGHT_PERMS.admin])
   @ApiOperation({
     summary:
       "Set the USD→ETB fallback by hand (used only while CBE is unreachable)",