fix(freight:backoffice): remove coarse fleet.view/fleet.manage/admin fallbacks

Now that every fleet-resource page and settings page has its own
dedicated permission key (previous commit), the broad fallbacks are
redundant and over-grant: anyone holding only fleet:view/fleet:manage
or admin could reach every page in that whole section, not just one.

Removed fleet.view fallback from: Routes, Locomotives, Train Builder,
Wagons, Containers, Cargoes, Compliance & Alerts, Procurement, and the
Overview dashboard's Fleet KPI tab.

Removed fleet.manage fallback from: canFleetAction() (per-resource
fleet CRUD, lib/permissions.ts) and TrainBuilderDetailPage's wagon-
assignment check. Hard-delete already had no such fallback.

Removed admin fallback from: File settings, Dropdown settings,
Contract templates, Portal content, Trade access, Exchange rate.

Left untouched: Incidents (sole gate is fleet.view — no dedicated
edr_freight_app:incidents:* key exists on the backend yet, so there's
nothing to fall back FROM; removing it would make the page
super-admin-only).

Access-narrowing change: anyone currently relying on the coarse grant
without also holding the specific resource/settings key will lose
access to these pages until roles are updated to grant the specific
keys directly. Audit role assignments before this deploys.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/edr-freight-web/backoffice/src/App.tsx

@@ -573,9 +573,7 @@ const App = () => {
         <Route
           path="routes"
           element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.routes.view, FREIGHT_PERMS.fleet.view]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.routes.view}>
               <RoutesPage />
             </RequirePermission>
           }
@@ -583,12 +581,7 @@ const App = () => {
         <Route
           path="locomotives"
           element={
-            <RequirePermission
-              permission={[
-                FREIGHT_PERMS.locomotives.view,
-                FREIGHT_PERMS.fleet.view,
-              ]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.locomotives.view}>
               <FleetResourcePage />
             </RequirePermission>
           }
@@ -596,9 +589,7 @@ const App = () => {
         <Route
           path="trains"
           element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.trains.view}>
               <FleetResourcePage />
             </RequirePermission>
           }
@@ -606,9 +597,7 @@ const App = () => {
         <Route
           path="trains/:id"
           element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.trains.view}>
               <TrainDetailPage />
             </RequirePermission>
           }
@@ -616,9 +605,7 @@ const App = () => {
         <Route
           path="train-builder"
           element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.trains.view}>
               <TrainBuilderListPage />
             </RequirePermission>
           }
@@ -626,9 +613,7 @@ const App = () => {
         <Route
           path="train-builder/:id"
           element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.trains.view, FREIGHT_PERMS.fleet.view]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.trains.view}>
               <TrainBuilderDetailPage />
             </RequirePermission>
           }
@@ -636,9 +621,7 @@ const App = () => {
         <Route
           path="wagons"
           element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.wagons.view, FREIGHT_PERMS.fleet.view]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.wagons.view}>
               <FleetResourcePage />
             </RequirePermission>
           }
@@ -659,12 +642,7 @@ const App = () => {
         <Route
           path="containers"
           element={
-            <RequirePermission
-              permission={[
-                FREIGHT_PERMS.containers.view,
-                FREIGHT_PERMS.fleet.view,
-              ]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.containers.view}>
               <FleetResourcePage />
             </RequirePermission>
           }
@@ -672,12 +650,7 @@ const App = () => {
         <Route
           path="cargoes"
           element={
-            <RequirePermission
-              permission={[
-                FREIGHT_PERMS.cargoes.view,
-                FREIGHT_PERMS.fleet.view,
-              ]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.cargoes.view}>
               <FleetResourcePage />
             </RequirePermission>
           }
@@ -765,9 +738,7 @@ const App = () => {
         <Route
           path="compliance"
           element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.compliance.view, FREIGHT_PERMS.fleet.view]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.compliance.view}>
               <CompliancePage />
             </RequirePermission>
           }
@@ -791,9 +762,7 @@ const App = () => {
         <Route
           path="procurement"
           element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.procurement.view, FREIGHT_PERMS.fleet.view]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.procurement.view}>
               <ProcurementPage />
             </RequirePermission>
           }
@@ -816,9 +785,7 @@ const App = () => {
         <Route
           path="file-settings"
           element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.settings.fileUpload.view, FREIGHT_PERMS.admin]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.settings.fileUpload.view}>
               <FileUploadSettingsPage />
             </RequirePermission>
           }
@@ -826,9 +793,7 @@ const App = () => {
         <Route
           path="dropdown-settings"
           element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.settings.dropdown.view, FREIGHT_PERMS.admin]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.settings.dropdown.view}>
               <DropdownSettingsPage />
             </RequirePermission>
           }
@@ -845,10 +810,7 @@ const App = () => {
           path="contract-templates"
           element={
             <RequirePermission
-              permission={[
-                FREIGHT_PERMS.settings.contractTemplates.view,
-                FREIGHT_PERMS.admin,
-              ]}
+              permission={FREIGHT_PERMS.settings.contractTemplates.view}
             >
               <ContractTemplatesPage />
             </RequirePermission>
@@ -858,10 +820,7 @@ const App = () => {
           path="contract-templates/:code"
           element={
             <RequirePermission
-              permission={[
-                FREIGHT_PERMS.settings.contractTemplates.view,
-                FREIGHT_PERMS.admin,
-              ]}
+              permission={FREIGHT_PERMS.settings.contractTemplates.view}
             >
               <ContractTemplateEditorPage />
             </RequirePermission>
@@ -874,7 +833,6 @@ const App = () => {
               permission={[
                 FREIGHT_PERMS.settings.supportContent.view,
                 FREIGHT_PERMS.settings.supportContent.manage,
-                FREIGHT_PERMS.admin,
               ]}
             >
               <PortalContentPage />
@@ -899,9 +857,7 @@ const App = () => {
         <Route
           path="configuration/trade-access"
           element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.tradeAccess.view, FREIGHT_PERMS.admin]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.tradeAccess.view}>
               <TradeAccessPage />
             </RequirePermission>
           }
@@ -909,9 +865,7 @@ const App = () => {
         <Route
           path="configuration/exchange-rate"
           element={
-            <RequirePermission
-              permission={[FREIGHT_PERMS.settings.exchangeRate.view, FREIGHT_PERMS.admin]}
-            >
+            <RequirePermission permission={FREIGHT_PERMS.settings.exchangeRate.view}>
               <div className="p-4">
                 <ExchangeRateSettingsCard />
               </div>