fix(freight-permissions): split company stamp from per-officer teeter permission

apps/edr-freight-api/src/modules/stamp-settings/stamp-settings.controller.ts

@@ -15,21 +15,21 @@ export class StampSettingsController {
   constructor(private readonly service: StampSettingsService) {}
 
   @Get()
-  @BookingStaff([FREIGHT_PERMS.settings.invoiceStamp.view, FREIGHT_PERMS.admin])
+  @BookingStaff([FREIGHT_PERMS.settings.stamp.view, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Current company stamp used on invoice/receipt PDFs" })
   get() {
     return this.service.getView();
   }
 
   @Put()
-  @BookingStaff([FREIGHT_PERMS.settings.invoiceStamp.manage, FREIGHT_PERMS.admin])
+  @BookingStaff([FREIGHT_PERMS.settings.stamp.manage, FREIGHT_PERMS.admin])
   @ApiOperation({ summary: "Replace the company stamp" })
   update(@Body() dto: UpdateStampSettingDto, @CurrentUser() user: TCurrentUser) {
     return this.service.setStamp(dto.stampImageBase64, user?.id ?? null);
   }
 
   @Delete()
-  @BookingStaff([FREIGHT_PERMS.settings.invoiceStamp.manage, FREIGHT_PERMS.admin])
+  @BookingStaff([FREIGHT_PERMS.settings.stamp.manage, FREIGHT_PERMS.admin])
   @ApiOperation({
     summary: "Clear the company stamp (invoices fall back to the plain seal)",
   })

apps/edr-freight-api/src/seed/freight-permissions.registry.ts

@@ -1190,22 +1190,28 @@ export const CONFIG_SETTINGS_PERMISSIONS: FreightPermissionSeed[] = [
   perm(
     "b4b00002-0001-4000-8000-000000000001",
     "edr_freight_app:settings:stamp:view",
-    "View stamp settings",
+    "View the company stamp",
   ),
   perm(
     "b4b00002-0001-4000-8000-000000000002",
     "edr_freight_app:settings:stamp:manage",
-    "Manage stamp settings",
+    "Manage the company stamp",
   ),
+  // The per-officer approval teeter (ማህተም) — an individual's own stamp +
+  // signature, not the company seal. It used to ride on settings:stamp:*, which
+  // now gates the ONE company stamp; this key was split out when the two were
+  // untangled. `settings:invoice_stamp:*` retired at the same time: it gated the
+  // company stamp before the fold and is deliberately left orphaned in any DB
+  // that already seeded it (the seeder upserts by key and never deletes).
   perm(
     "b4b00003-0001-4000-8000-000000000001",
-    "edr_freight_app:settings:invoice_stamp:view",
-    "View invoice stamp settings",
+    "edr_freight_app:settings:teeter:view",
+    "View own approval teeter and signature",
   ),
   perm(
     "b4b00003-0001-4000-8000-000000000002",
-    "edr_freight_app:settings:invoice_stamp:manage",
-    "Manage invoice stamp settings",
+    "edr_freight_app:settings:teeter:manage",
+    "Manage own approval teeter and signature",
   ),
   perm(
     "b4c00001-0001-4000-8000-000000000001",
@@ -1907,15 +1913,18 @@ export const FREIGHT_PERMS = {
       view: "edr_freight_app:settings:dropdown:view",
       manage: "edr_freight_app:settings:dropdown:manage",
     },
+    // The ONE company stamp/seal, applied to every generated document
+    // (invoices, receipts, warehouse papers, the EDR side of contracts).
     stamp: {
       view: "edr_freight_app:settings:stamp:view",
       manage: "edr_freight_app:settings:stamp:manage",
     },
-    // Company stamp/seal image stamped onto invoice/receipt PDFs — separate
-    // from `stamp` above, which is the per-employee approval-record teeter.
-    invoiceStamp: {
-      view: "edr_freight_app:settings:invoice_stamp:view",
-      manage: "edr_freight_app:settings:invoice_stamp:manage",
+    // The per-officer approval teeter (ማህተም) + signature — genuinely per-person,
+    // and NOT the company seal above. Retired: `invoiceStamp`, which used to
+    // gate the company stamp before the two were untangled.
+    teeter: {
+      view: "edr_freight_app:settings:teeter:view",
+      manage: "edr_freight_app:settings:teeter:manage",
     },
     exchangeRate: {
       view: "edr_freight_app:settings:exchange_rate:view",