fix issue

apps/edr-freight-api/src/modules/files/files.controller.ts

@@ -6,22 +6,24 @@ import {
   Query,
   Res,
 } from "@nestjs/common";
-import { ApiOperation, ApiQuery, ApiTags } from "@nestjs/swagger";
-import { Public } from "@edr/api-common";
+import { ApiBearerAuth, ApiOperation, ApiQuery, ApiTags } from "@nestjs/swagger";
 import { Response } from "express";
 
 import { FilesService } from "./files.service";
 
 @ApiTags("files")
+@ApiBearerAuth()
 @Controller("files")
 export class FilesController {
   constructor(private readonly filesService: FilesService) {}
 
   @Get(":fileId")
-  // Public so the browser can load the bytes directly via <img>/<iframe>/<a> —
-  // those requests can't carry the Bearer token the axios client injects, so a
-  // guarded route 401s. File UUIDs are unguessable; same tradeoff as webhooks.
-  @Public()
+  // Authenticated: no @Public, so the global JwtGuard applies. Unguessable file
+  // UUIDs are obscurity, not authorization — raw byte streams must require auth.
+  // Browser inline previews (<img>/<iframe>/<a>) that can't carry the Bearer
+  // token should use a short-lived signed URL instead (FilesService.signUrl).
+  // TODO: enforce ownership-by-resource here next (scope the file to the
+  // caller's booking/company before streaming).
   @ApiOperation({
     summary: "Stream a file by ID",
     description: