feat(backoffice): guard routes and actions by permission

Mirrors the new keys in lib/permissions.ts, wraps the warehouse,
overview, reports, support and booking-request routes in
RequirePermission, and gates the dispatch, mark-paid, invoice pay/cancel,
export and support-send actions behind their own keys. Removes duplicate
route blocks.

apps/edr-freight-web/backoffice/src/pages/support/SupportInboxPage.tsx

@@ -51,6 +51,8 @@ import {
 } from "@/features/support/useSupport";
 import { useSupportSocket } from "@/features/support/useSupportSocket";
 import { customersService } from "@/services/customers.service";
+import { useAuth } from "@/auth/useAuth";
+import { FREIGHT_PERMS, hasPermission } from "@/lib/permissions";
 
 type ReadFilter = "ALL" | "UNREAD";
 
@@ -401,6 +403,8 @@ function ConversationThread({
     fetchNextPage,
   } = useMessages(conversation.id);
   const send = useSendMessage(conversation.id);
+  const { user: agentUser } = useAuth();
+  const canSend = hasPermission(agentUser, FREIGHT_PERMS.support.agentSend);
   const markRead = useMarkConversationRead();
   const [draft, setDraft] = useState("");
   const [dragging, setDragging] = useState(false);
@@ -656,7 +660,7 @@ function ConversationThread({
             color="edr-green"
             variant="filled"
             loading={send.isPending}
-            disabled={!draft.trim() && attach.attachments.length === 0}
+            disabled={!canSend || (!draft.trim() && attach.attachments.length === 0)}
             onClick={submit}
           >
             <Send size={18} />