feat(freight-api): seed a permission per report

Each report key (REPORT_KEYS) mints its own edr_freight_app:reports:<key>:view
permission, derived the same way rule-engine resource permissions are.
reports:view stays the section master key; STAFF_DASHBOARD_KEYS grants every
report key alongside it so existing presets don't regress on reseed.

apps/edr-freight-api/src/seed/freight-permissions.registry.ts

@@ -47,6 +47,36 @@ const perm = (id: string, key: string, en: string): FreightPermissionSeed => ({
   applicationKey: EDR_FREIGHT_APP_KEY,
 });
 
+/**
+ * One entry per report definition (see modules/reports/definitions). Each
+ * gets its own permission, gated behind the `reports:view` master key that
+ * opens the Reports section itself.
+ * Keep new keys at the END: reportPermId derives ids from list index, so a
+ * mid-list insert would shift ids already seeded for later keys.
+ */
+export const REPORT_KEYS = [
+  "bookings-list",
+  "revenue-by-customer",
+  "aging-receivables",
+  "contract-utilization",
+] as const;
+
+export type ReportKey = (typeof REPORT_KEYS)[number];
+
+export const reportPermissionKey = (key: ReportKey): string =>
+  `edr_freight_app:reports:${key.replace(/-/g, "_")}:view`;
+
+const reportPermId = (index: number): string =>
+  `a4f00002-0001-4000-8000-${(index + 1).toString(16).padStart(12, "0")}`;
+
+const titleCase = (slug: string): string =>
+  slug.split("-").map((w) => w[0].toUpperCase() + w.slice(1)).join(" ");
+
+export const REPORT_PERMISSIONS: FreightPermissionSeed[] = REPORT_KEYS.map(
+  (key, index) =>
+    perm(reportPermId(index), reportPermissionKey(key), `Report: ${titleCase(key)}`),
+);
+
 export const BOOKING_PERMISSIONS: FreightPermissionSeed[] = [
   perm(
     "a1000001-0001-4000-8000-000000000001",
@@ -1506,6 +1536,7 @@ export const NOTIFICATION_PERMISSIONS: FreightPermissionSeed[] = [
 ];
 
 export const ADVANCED_BACKOFFICE_PERMISSIONS: FreightPermissionSeed[] = [
+  ...REPORT_PERMISSIONS,
   ...CUSTOMER_PERMISSIONS,
   ...FINANCE_PERMISSIONS,
   ...MILE_PERMISSIONS,
@@ -1987,6 +2018,7 @@ export const FREIGHT_PERMS = {
   },
   reports: {
     view: "edr_freight_app:reports:view",
+    report: (key: ReportKey): string => reportPermissionKey(key),
   },
   staff: {
     users: {
@@ -2131,11 +2163,17 @@ const FLEET_GRANULAR_KEYS: string[] = [
   FREIGHT_PERMS.consignments.create,
 ];
 
+const allReportKeys = (): string[] => REPORT_KEYS.map((k) => reportPermissionKey(k));
+
 // Everyone who works the booking desk also opens the overview dashboard and
 // the canned reports — granted alongside bookings:view in every preset below.
+// Each report also carries its own key (see REPORT_PERMISSIONS); spreading
+// allReportKeys() here keeps every existing preset seeing every report, same
+// as when reports:view alone gated the whole section.
 const STAFF_DASHBOARD_KEYS: string[] = [
   FREIGHT_PERMS.overview.view,
   FREIGHT_PERMS.reports.view,
+  ...allReportKeys(),
 ];
 
 // Notification desks — recipient selectors, not access. A preset gets a desk