feat(auth): gate and regate freight API controllers

Gates the previously open support-agent, procurement, compliance,
facilities, list-users and trade-access controllers, separates customer
from staff routes across bookings, contracts, companies, billing,
warehouses, files and train scheduling, and moves billing, overview,
reports and the settings controllers onto their own keys instead of the
blanket admin key. Drops the demo-permissions module and the untested
notification test route.

apps/edr-freight-api/src/modules/train-scheduling/train-scheduling.controller.ts

@@ -10,6 +10,9 @@ import {
 import { CurrentUser } from "@edr/api-common";
 import {
   BookingDocReviewAlert,
+  BookingStaff,
+  MixedAudience,
+  PortalCustomer,
   TrainSchedulingCancel,
   TrainSchedulingCreate,
   TrainSchedulingReschedule,
@@ -17,6 +20,7 @@ import {
   TrainSchedulingUpdate,
   TrainSchedulingView,
 } from "../../common/booking-guards";
+import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { AcceptIntercityBookingsDto } from "./dto/accept-intercity-bookings.dto";
 import { AssignBookingsDto } from "./dto/assign-bookings.dto";
 import { AssignUnassignedBookingDto } from "./dto/assign-unassigned-booking.dto";
@@ -71,6 +75,7 @@ export class TrainSchedulingController {
   ) { }
 
   @Get("my-booking-windows")
+  @PortalCustomer()
   @ApiOperation({
     summary:
       "Upcoming/open booking windows announced to the signed-in customer (all window-engine schedules; their own contract lanes carry a Book-now target)",
@@ -85,6 +90,10 @@ export class TrainSchedulingController {
   }
 
   @Get("contracts/:contractId/booking-windows")
+  @MixedAudience([
+    FREIGHT_PERMS.trainScheduling.view,
+    FREIGHT_PERMS.contracts.createBooking,
+  ])
   @ApiOperation({
     summary:
       "Upcoming/open booking windows on a contract's routes — gates the booking form for customer + Ethiopian GL",
@@ -496,14 +505,14 @@ export class TrainSchedulingController {
   }
 
   @Post("schedules/:id/finalize")
-  @TrainSchedulingUpdate()
+  @BookingStaff(FREIGHT_PERMS.trainScheduling.dispatch)
   @ApiOperation({ summary: "Finalize a draft train schedule" })
   finalizeSchedule(@Param("id", ParseUUIDPipe) id: string) {
     return this.trainSchedulingService.finalizeSchedule(id);
   }
 
   @Post("schedules/:id/dispatch")
-  @TrainSchedulingUpdate()
+  @BookingStaff(FREIGHT_PERMS.trainScheduling.dispatch)
   @ApiOperation({ summary: "Dispatch a scheduled train" })
   dispatchSchedule(@Param("id", ParseUUIDPipe) id: string) {
     return this.trainSchedulingService.dispatchSchedule(id);
@@ -824,7 +833,7 @@ export class TrainSchedulingController {
   }
 
   @Post("bookings/:bookingId/mark-paid")
-  @TrainSchedulingUpdate()
+  @BookingStaff(FREIGHT_PERMS.trainScheduling.markPaid)
   @ApiOperation({
     summary: "Staff: mark a reserved booking paid and allocate it now",
   })
@@ -834,7 +843,7 @@ export class TrainSchedulingController {
   }
 
   @Post("bookings/:bookingId/expire")
-  @TrainSchedulingUpdate()
+  @BookingStaff(FREIGHT_PERMS.trainScheduling.expireBooking)
   @ApiOperation({
     summary: "Staff: expire a reservation and free its capacity",
   })