Add fleet management and admin permissions, and update controllers to enforce new permissions

apps/edr-freight-api/src/modules/payment/payment.controller.ts

@@ -17,6 +17,7 @@ import {
 } from "@nestjs/swagger";
 import { Response } from "express";
 import { Public } from "@edr/api-common";
+import { FreightAdmin } from "../../common/booking-guards";
 import { PaymentService } from "./payment.service";
 import {
     InitiatePaymentDto,
@@ -33,6 +34,7 @@ export class PaymentController {
     constructor(private readonly paymentService: PaymentService) { }
 
     @Get("all")
+    @FreightAdmin()
     @ApiOperation({ summary: "Get all payments with filters (staff/admin only)" })
     @ApiQuery({ name: "search", required: false })
     @ApiQuery({ name: "status", required: false })
@@ -73,6 +75,7 @@ export class PaymentController {
     }
 
     @Post("refund")
+    @FreightAdmin()
     @ApiOperation({ summary: "Refund a paid booking (staff/admin only)" })
     refund(@Body() dto: RefundDto) {
         return this.paymentService.refund(dto);