feat(auth): regate payment, booking and wagon reads

Payment summary/all moved off bookings:view onto payments:view, the
booking list now requires bookings:view for staff instead of accepting
any employee, and wagon reads require wagons:view or fleet:view rather
than bare authentication.

apps/edr-freight-api/src/modules/bookings/bookings.controller.ts

@@ -212,7 +212,7 @@ export class BookingsController {
   }
 
   @Get()
-  @MixedAudience([])
+  @MixedAudience(FREIGHT_PERMS.bookings.view)
   @ApiOperation({ summary: "List freight bookings (paginated)" })
   async findAll(
     @Query() filter: FilterBookingDto,