implement freight permissions for trains, wagons, and routes

apps/edr-freight-web/backoffice/src/lib/permissions.ts

@@ -507,6 +507,31 @@ export function canViewFleet(user: AuthUser | null | undefined): boolean {
   return hasPermission(user, FREIGHT_PERMS.fleet.view);
 }
 
+export type FleetCrudResource =
+  | "locomotives"
+  | "wagons"
+  | "trains"
+  | "routes"
+  | "containers"
+  | "cargoes"
+  | "vehicles"
+  | "drivers";
+
+/**
+ * Per-resource fleet CRUD check. The legacy coarse fleet:manage key still
+ * grants every action (mirrors the API's one-of guard fallback).
+ */
+export function canFleetAction(
+  user: AuthUser | null | undefined,
+  resource: FleetCrudResource,
+  action: "create" | "update" | "delete",
+): boolean {
+  return (
+    hasPermission(user, FREIGHT_PERMS[resource][action]) ||
+    hasPermission(user, FREIGHT_PERMS.fleet.manage)
+  );
+}
+
 export function isFreightAdmin(user: AuthUser | null | undefined): boolean {
   return hasPermission(user, FREIGHT_PERMS.admin);
 }