fix(auth): stop class guards shadowing route permission keys

Nest runs class and method guards together, so a class-level view key
ANDs with every action key below it. Staff granted only an action were
denied before their key was ever checked: OCC could not fulfil wagon
transfers, dispatchers could not create a yard, and track staff could not
assign first/last-mile vehicles. Reads now carry the view key themselves,
and the warehouses baseline lists every key its routes use.

apps/edr-freight-api/src/modules/warehouses/warehouses.controller.ts

@@ -14,13 +14,19 @@ import { WarehousesService } from './warehouses.service';
 @ApiTags('warehouses')
 @ApiBearerAuth()
 // Baseline read: warehouse reference data is consumed by inventory/dashboard
-// flows too, so any of the three view permissions grants reads. Writes stack
-// their specific create/update permission per route on top.
+// flows too, so any of the view permissions grants reads. Writes stack their
+// specific create/update permission per route on top — which means every key
+// used by a route below must also appear here, or the class guard denies
+// before the route's own key is ever consulted (Nest ANDs the two).
 @Controller('warehouses')
 @BookingStaff([
   FREIGHT_PERMS.warehouses.view,
   FREIGHT_PERMS.warehouseInventory.view,
   FREIGHT_PERMS.warehouseDashboard.view,
+  FREIGHT_PERMS.warehouses.create,
+  FREIGHT_PERMS.warehouses.update,
+  FREIGHT_PERMS.warehouseYards.view,
+  FREIGHT_PERMS.warehouseYards.create,
 ])
 export class WarehousesController {
   constructor(