fix(auth): keep secondary positions in permission checks

IAM lets an employee hold several positions, but the vendored JwtGuard
collapses employee.positions[] down to a single employee.position and
drops the rest. Non-delegate secondary positions vanished entirely, so
staff on two posts resolved to one post's permissions and every check
on the other rejected them.

FreightJwtGuard re-attaches the full list from the same session
snapshot the parent guard already read, so nothing extra is fetched
per request beyond a cached session lookup. employee.position is left
untouched, keeping audit logging and delegation unaffected.
collectPermissionKeys and collectPositionTypeKeys now union across
every position, and /me returns them all.

Verified against a real two-position user (djibouti-gl-director +
djibouti-gl-chief) on the local dev database:

  /me positions                     1   -> 2
  /me permissionKeys                17  -> 28
  GET /api/interchange-documents    403 -> 200
  GET /api/trains                   403 -> 200

11 permissions recovered, none lost. Six single-position users return
byte-identical payloads before and after.

apps/edr-freight-api/src/modules/verifayda/verifayda.controller.ts

@@ -17,7 +17,7 @@ import {
 } from '@nestjs/swagger';
 import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
-import { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
+import { FreightJwtGuard } from '../../common/freight-jwt.guard';
 import { OptionalJwtGuard } from './optional-jwt.guard';
 import {
   CompleteVerificationResultDto,
@@ -91,7 +91,7 @@ export class VerifaydaController {
   }
 
   @Get('status')
-  @UseGuards(JwtGuard)
+  @UseGuards(FreightJwtGuard)
   @ApiBearerAuth('JWT-auth')
   @ApiOperation({
     summary: "Get the current user's Fayda verification status",