feat(auth): regate payment, booking and wagon reads

Payment summary/all moved off bookings:view onto payments:view, the
booking list now requires bookings:view for staff instead of accepting
any employee, and wagon reads require wagons:view or fleet:view rather
than bare authentication.

apps/edr-freight-api/src/modules/bookings/bookings.controller.ts

@@ -212,7 +212,7 @@ export class BookingsController {
   }
 
   @Get()
-  @MixedAudience([])
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({ summary: "List freight bookings (paginated)" })
   async findAll(
     @Query() filter: FilterBookingDto,

apps/edr-freight-api/src/modules/payment/payment.controller.ts

@@ -18,7 +18,7 @@ import {
 import { Response } from "express";
 import { CurrentUser, Public } from "@edr/api-common";
 import type { TCurrentUser } from "@tria-plc/api-common/modules/auth/types/current-user.type";
-import { BookingStaff, BookingView, MixedAudience, PortalCustomer } from "../../common/booking-guards";
+import { BookingStaff, MixedAudience, PortalCustomer } from "../../common/booking-guards";
 import { UserTradeAccessService } from "../user-trade-access/user-trade-access.service";
 import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
 import { PaymentService } from "./payment.service";
@@ -43,14 +43,14 @@ export class PaymentController {
     }
 
     @Get("summary")
-    @BookingView()
+    @BookingStaff(FREIGHT_PERMS.payments.view)
     @ApiOperation({ summary: "Payment count/amount summary for dashboard cards" })
     getSummary() {
         return this.paymentService.getSummary();
     }
 
     @Get("all")
-    @BookingView()
+    @BookingStaff(FREIGHT_PERMS.payments.view)
     @ApiOperation({ summary: "Get all payments with filters (view-only, any staff)" })
     @ApiQuery({ name: "search", required: false })
     @ApiQuery({ name: "status", required: false })

apps/edr-freight-api/src/modules/wagons/wagons.controller.ts

@@ -17,7 +17,7 @@ import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/curre
 import {
   BookingStaff,
   FleetManage,
-  StaffReference,
+  FleetView,
 } from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { CreateWagonDto } from './dto/create-wagon.dto';
@@ -44,7 +44,7 @@ export class WagonsController {
   }
 
   @Get()
-  @StaffReference()
+  @FleetView(FREIGHT_PERMS.wagons.view)
   @ApiOperation({
     summary: 'List wagons, paginated ({items, meta}) — 10 per page by default',
   })
@@ -53,14 +53,14 @@ export class WagonsController {
   }
 
   @Get(':id')
-  @StaffReference()
+  @FleetView(FREIGHT_PERMS.wagons.view)
   @ApiOperation({ summary: 'Get a wagon by ID' })
   findOne(@Param('id', ParseUUIDPipe) id: string) {
     return this.wagonsService.findById(id);
   }
 
   @Get(':id/movements')
-  @StaffReference()
+  @FleetView(FREIGHT_PERMS.wagons.view)
   @ApiOperation({
     summary: "Wagon movement ledger (loaded legs, empty repositions, manual moves), newest first",
   })