feat(auth): deny by default with employee/customer audience guards

FreightPermissionGuard now rejects non-employee user types before the key
check, making every BookingStaff route staff-only in one place. Adds
PortalCustomer and MixedAudience for the routes both audiences share, and
stops ServiceAuthGuard failing open when SERVICE_AUTH_TOKEN is unset.

apps/edr-freight-api/src/common/booking-guards.ts

@@ -1,7 +1,11 @@
 import { applyDecorators, UseGuards } from '@nestjs/common';
 import { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
 
-import { FreightPermissionGuard } from './freight-permission.guard';
+import {
+  FreightPermissionGuard,
+  MixedAudienceGuard,
+  PortalCustomerGuard,
+} from './freight-permission.guard';
 import { FREIGHT_PERMS } from '../seed/freight-permissions.registry';
 
 export const BookingStaff = (permission: string | string[]) =>
@@ -18,8 +22,30 @@ export const BookingStaff = (permission: string | string[]) =>
  * Read-only reference data (yard dropdowns, search filters): any signed-in
  * staff. Menu/page visibility stays permission-gated in the frontend — this
  * only lets forms populate their lookups.
+ * Deprecated for new routes — it never checked the caller was staff. Prefer
+ * BookingStaff(<view key>) or MixedAudience(); kept for routes not yet swept.
  */
-export const StaffReference = () => applyDecorators(UseGuards(JwtGuard));
+export const StaffReference = () =>
+  applyDecorators(UseGuards(JwtGuard, FreightPermissionGuard([])));
+
+/** Portal routes: customer accounts only; ownership scoping stays in services. */
+export const PortalCustomer = () =>
+  applyDecorators(UseGuards(JwtGuard, PortalCustomerGuard));
+
+/**
+ * Routes both audiences call (sign, shared document reads, handover): staff
+ * need one of the given permissions, customers pass through to the service's
+ * ownership checks.
+ */
+export const MixedAudience = (permission: string | string[]) =>
+  applyDecorators(
+    UseGuards(
+      JwtGuard,
+      MixedAudienceGuard(
+        Array.isArray(permission) ? permission : [permission],
+      ),
+    ),
+  );
 
 export const BookingView = () => BookingStaff(FREIGHT_PERMS.bookings.view);