feat(auth): gate and regate freight API controllers

Gates the previously open support-agent, procurement, compliance,
facilities, list-users and trade-access controllers, separates customer
from staff routes across bookings, contracts, companies, billing,
warehouses, files and train scheduling, and moves billing, overview,
reports and the settings controllers onto their own keys instead of the
blanket admin key. Drops the demo-permissions module and the untested
notification test route.

apps/edr-freight-api/src/modules/notification-inbox/notification-inbox.controller.ts

@@ -1,11 +1,5 @@
 import { CurrentUser } from "@edr/api-common";
 import {
-  NotificationAudience,
-  NotificationPriority,
-  NotificationType,
-} from "@edr/types";
-import {
-  Body,
   Controller,
   Get,
   Param,
@@ -62,22 +56,4 @@ export class NotificationInboxController {
     return this.service.markAllRead(resolveAuthUserId(user));
   }
 
-  // TODO: remove before merge — dev/verification helper only.
-  @Post("test")
-  @ApiOperation({
-    summary: "[dev] Send a test notification to the current user",
-  })
-  sendTest(
-    @CurrentUser() user: AuthUserPayload,
-    @Body()
-    body: {
-      audience?: NotificationAudience;
-      type?: NotificationType;
-      priority?: NotificationPriority;
-      title?: string;
-      message?: string;
-    },
-  ) {
-    return this.service.sendTestToUser(resolveAuthUserId(user), body ?? {});
-  }
 }

apps/edr-freight-api/src/modules/notification-inbox/notification-inbox.service.ts

@@ -1,11 +1,9 @@
 import {
-  NotificationAudience,
   NotificationChannels,
   NotificationChannelsSent,
   NotificationDto,
   NotificationListResult,
   NotificationPriority,
-  NotificationType,
   NotifyInput,
 } from "@edr/types";
 import { Injectable, Logger } from "@nestjs/common";
@@ -106,31 +104,6 @@ export class NotificationInboxService {
     return { updated, unreadCount };
   }
 
-  /** [dev/verification only] Send a canned notification straight to one user. */
-  async sendTestToUser(
-    userId: string,
-    body: {
-      audience?: NotificationAudience;
-      type?: NotificationType;
-      priority?: NotificationPriority;
-      title?: string;
-      message?: string;
-    },
-  ): Promise<NotificationDto> {
-    const entity = await this.repo.create({
-      recipientUserId: userId,
-      audience: body.audience ?? NotificationAudience.BACKOFFICE,
-      type: body.type ?? NotificationType.GENERIC,
-      title: body.title ?? "Test notification",
-      body: body.message ?? "This is a test in-app notification.",
-      priority: body.priority ?? NotificationPriority.NORMAL,
-      isRead: false,
-    });
-    const dto = this.toDto(entity);
-    this.gateway.emitNew(userId, dto, await this.repo.countUnread(userId));
-    return dto;
-  }
-
   private async deliverToUser(
     userId: string,
     input: NotifyInput,