Card called GET /warehouse-inventory (staff perm) → 403 swallowed as

empty state. New customer-safe bookings/:id/location endpoint returns
location fields only; card now uses it.

apps/edr-freight-api/src/modules/warehouses/warehouse-inventory.controller.ts

@@ -556,6 +556,12 @@ export class WarehouseInventoryController {
     return this.inventoryService.bookingContainerWeights(bookingId);
   }
 
+  @Get('bookings/:bookingId/location')
+  @ApiOperation({ summary: "Warehouse location of a booking's inventory (customer portal)" })
+  bookingLocation(@Param('bookingId', ParseUUIDPipe) bookingId: string) {
+    return this.inventoryService.bookingLocation(bookingId);
+  }
+
   @Post(':id/deliver')
   @BookingStaff(FREIGHT_PERMS.warehouseInventory.deliver)
   @ApiOperation({ summary: 'Deliver import goods to the customer + capture proof of delivery' })