feat(auth): regate payment, booking and wagon reads

Payment summary/all moved off bookings:view onto payments:view, the
booking list now requires bookings:view for staff instead of accepting
any employee, and wagon reads require wagons:view or fleet:view rather
than bare authentication.

apps/edr-freight-api/src/modules/wagons/wagons.controller.ts

@@ -17,7 +17,7 @@ import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/curre
 import {
   BookingStaff,
   FleetManage,
-  StaffReference,
+  FleetView,
 } from '../../common/booking-guards';
 import { FREIGHT_PERMS } from '../../seed/freight-permissions.registry';
 import { CreateWagonDto } from './dto/create-wagon.dto';
@@ -44,7 +44,7 @@ export class WagonsController {
   }
 
   @Get()
-  @StaffReference()
+  @FleetView(FREIGHT_PERMS.wagons.view)
   @ApiOperation({
     summary: 'List wagons, paginated ({items, meta}) — 10 per page by default',
   })
@@ -53,14 +53,14 @@ export class WagonsController {
   }
 
   @Get(':id')
-  @StaffReference()
+  @FleetView(FREIGHT_PERMS.wagons.view)
   @ApiOperation({ summary: 'Get a wagon by ID' })
   findOne(@Param('id', ParseUUIDPipe) id: string) {
     return this.wagonsService.findById(id);
   }
 
   @Get(':id/movements')
-  @StaffReference()
+  @FleetView(FREIGHT_PERMS.wagons.view)
   @ApiOperation({
     summary: "Wagon movement ledger (loaded legs, empty repositions, manual moves), newest first",
   })