feat(overview): resolve dashboard layout from permissions, not role keys

role-dashboards.config.ts's ROLE_LAYOUTS was a hand-typed table of ~40
raw role/position keys (including edr_freight_app/xxx ad-hoc
sub-positions), matched against the user's held keys client-side.
Replaced with resolveOverviewLayout(), which just picks the
highest-priority key out of whatever GET /overview/layouts returns —
the same 'server filters by permission, frontend renders what comes
back' shape Reports already uses, so the frontend no longer needs to
know any individual permission key.

Hard cutover: no fallback to the old key table. Positions not covered
by the previous commit's grants (the ad-hoc department sub-positions)
will render the executive layout until granted a layout permission.

apps/edr-freight-web/backoffice/src/services/overview.service.ts

@@ -1,6 +1,7 @@
 import { api as client } from "../auth/http";
 import { unwrap } from "@/utils/endpoint";
 import { URL_CONSTANTS } from "@/constants/URLS";
+import type { OverviewLayoutKey } from "@/components/overview/role-dashboards.config";
 import type {
   IOverviewBillingTab,
   IOverviewBookingsTab,
@@ -16,7 +17,19 @@ import type {
 
 const O = URL_CONSTANTS.OVERVIEW;
 
+/** Mirrors the API's OverviewLayoutDto — one entry per GET /overview/layouts item. */
+export interface IOverviewLayoutOption {
+  key: OverviewLayoutKey;
+  label: string;
+}
+
 export const overviewService = {
+  /** Layouts the caller has permission to render, in server priority order. */
+  getLayouts: async (): Promise<IOverviewLayoutOption[]> => {
+    const response = await client.get<IOverviewLayoutOption[]>(O.LAYOUTS);
+    return unwrap(response);
+  },
+
   getDashboard: async (range?: OverviewRange): Promise<IOverviewDashboard> => {
     const response = await client.get<IOverviewDashboard>(O.BASE, {
       params: range ? { range } : undefined,