feat(backoffice): guard routes and actions by permission

Mirrors the new keys in lib/permissions.ts, wraps the warehouse,
overview, reports, support and booking-request routes in
RequirePermission, and gates the dispatch, mark-paid, invoice pay/cancel,
export and support-send actions behind their own keys. Removes duplicate
route blocks.

apps/edr-freight-web/backoffice/src/components/trainScheduling/ScheduleBatchPanel.tsx

@@ -19,6 +19,8 @@ import { BookingStatusBadge } from "@/components/bookings/BookingStatusBadge";
 import { api } from "@/services/api";
 import { useToast } from "@/hooks/use-toast";
 import type { TrainScheduleDetail } from "@/types/trainScheduling";
+import { useAuth } from "@/auth/useAuth";
+import { FREIGHT_PERMS, hasPermission } from "@/lib/permissions";
 
 interface ScheduleBatchPanelProps {
   schedule: TrainScheduleDetail;
@@ -31,6 +33,8 @@ const windowColor: Record<string, string> = {
 };
 
 export function ScheduleBatchPanel({ schedule }: ScheduleBatchPanelProps) {
+  const { user } = useAuth();
+  const canMarkPaid = hasPermission(user, FREIGHT_PERMS.trainScheduling.markPaid);
   const { toast } = useToast();
   const actions = {
     runBatch: useMutation(api.trainScheduling.runBatch.mutationOptions()),
@@ -179,7 +183,7 @@ export function ScheduleBatchPanel({ schedule }: ScheduleBatchPanelProps) {
                 <Table.Td>
                   {!locked && (
                     <Group gap={6} justify="flex-end" wrap="nowrap">
-                      {b.status !== "PAID" && (
+                      {canMarkPaid && b.status !== "PAID" && (
                         <Button
                           size="compact-xs"
                           variant="light"