fix(permissions): enforce Fleet-Ops permissions across the API and console

[roncodes]

Summary

This PR comes out of an authorization audit of Fleet-Ops. Each finding was verified against a local stack as a non-admin (dispatcher) user.

Security

• GET fleet-ops/navigator/link-app was outside the authenticated group and redirected anonymous callers with an API key for the first system admin's organization.
  • The console now requests a 30-minute HMAC-signed link, and only system admins can request one (get-link-app is behind fleetbase.protected).
  • link-app rejects unsigned, tampered or expired links with 403.
• Entity editing settings are one platform-wide map keyed by order config, and any user's save replaced the whole map.
  • Saves now merge only the session company's order configs, keeping other organizations' entries, and reads return only the company's own.
  • Driver onboard settings are pinned to the session company instead of a request-supplied companyId.

Schema (Auth/Schemas/FleetOps.php)

• Declares resources the UI already checked but that never existed, which left their API unguarded and their screens unreachable for non-admins: maintenance-schedule, device, sensor, device-event, telematic, warranty, purchase-rate, fuel-provider-connection, fuel-provider-transaction, fuel-provider-sync-run, analytics, scheduling-settings and tracking-settings. service-rate gains export.
• Fixes 'action' → 'actions' on the settings resources, so fleet-ops onboard payments is actually created.
• Grants the new resources in FleetManager, MaintenanceManager, ServiceRateManager, OperationsAdmin and DispatchManager.

Custom actions and non-resource controllers

• AuthorizationGuard maps an unmatched method by HTTP verb. For example, bulk dispatch required create order, unassign-vehicle required create driver, and trailer attach required create trailer.
• Controllers now declare $methodPermissions (method → schema permission). FleetOpsController registers it as controller middleware through the new AuthorizesMethods trait, and those methods carry #[SkipAuthorizationCheck].
• Controllers outside the guard now enforce permissions:
  • Analytics and Metrics: view analytics.
  • Live map feeds: the list permission of each layer.
  • Orchestrator: optimize / import / assign-driver-for order.
  • Manifests: list / view / cancel / delete / update order.
  • Radar write actions: update driver or vehicle.
  • Customer portal logins: reset-credentials-for customer.
  • Stripe: onboard / view payments.
  • Settings writes: the matching *-settings permission. Admin map and tracking settings: system admins.

Console

• Route guards: list guards on every index route that lacked one, and create / view / update guards on new, details and edit routes. Orders is the landing route, so a user without list order is sent to the first area they can open.
• Buttons and menus:
  • New / Import / Export buttons, bulk actions and row actions pass their permission.
  • The order details menu hides actions the user cannot perform.
• Navigation:
  • Sidebar hubs, header shortcuts and extension menu items (virtual route) are permission-aware.
  • Reports use the iam … report permissions the core reports API enforces.
• Live map: layers checked plural names (list vehicles), so non-admins saw an empty map. They now use singular resource names.
• Maintenance redirects: details and edit redirects used route names without the console.fleet-ops. prefix, and threw.

Behaviour changes to note

• Dispatching now needs dispatch order; it used to need update order. The built-in OrderCoordinator policy has no dispatch.
• FleetOps dashboards and metrics need view analytics.
• Run php artisan fleetbase:create-permissions after deploying.

Companion PRs

fleetbase/core-api#278 (core authorization gaps, reports on iam), fleetbase/ember-ui#185 (bulk action and header permissions), fleetbase/ember-core#94 (shortcut permissions).

Test plan

• Every server/tests file run through scripts/pest-runner.php. Two files fail, and they fail on release/v0.6.70 too: InternalImportExportControllerContractsTest and SmallControllerContractsTest.
• New and updated tests: signed, unsigned, tampered and expired Navigator links; entity editing merge and tenant scoping; driver onboard company pinning.
• Local stack as a dispatcher:
  • 200 on orders and live map.
  • 401 on devices, analytics, metrics, unassign-vehicle (assign-vehicle-for driver), trailer attach (attach-vehicle-for trailer), settings saves, orchestrator run and get-link-app.
  • Unsigned link-app → 403; signed → 302.
• eslint and ember-template-lint on the changed addon files.