feat: RBAC Phase 2d - Auswertung & Ausgabe auf @RequirePermission umgestellt

Dashboard, Search, Calendar, Statistics, Qr, Export, Documents:
@Roles(...) durch @RequirePermission(...) ersetzt bzw. neu eingefuehrt
(alle diese Controller hatten zuvor gar keine Rollenpruefung -
jeder eingeloggte Nutzer konnte lesen). Documents behaelt STAFF-Zugriff
auf Upload und Loeschen.

Verifiziert: tsc, lint, volle e2e-Suite 158/159 gruen (1 getrackter Skip).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

ApiCore-Backend/src/documents/documents.controller.ts

@@ -15,8 +15,8 @@ import {
 import { FileInterceptor } from '@nestjs/platform-express';
 import { ApiBearerAuth, ApiConsumes, ApiTags } from '@nestjs/swagger';
 import type { Response } from 'express';
-import { DocumentEntityType, LegacyRole as Role } from '../../generated/prisma';
-import { Roles } from '../auth/decorators/roles.decorator';
+import { DocumentEntityType } from '../../generated/prisma';
+import { RequirePermission } from '../auth/decorators/require-permission.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { isAllowedDocumentMimeType } from './document-mime-types';
@@ -35,6 +35,7 @@ function sanitizeFilenameHeader(fileName: string): string {
 export class DocumentsController {
   constructor(private readonly documentsService: DocumentsService) {}
 
+  @RequirePermission('documents:read')
   @Get()
   findAll(
     @Query('entityType') entityType: string,
@@ -56,7 +57,7 @@ export class DocumentsController {
     );
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('documents:upload')
   @Post()
   @ApiConsumes('multipart/form-data')
   @UseInterceptors(
@@ -90,6 +91,7 @@ export class DocumentsController {
     );
   }
 
+  @RequirePermission('documents:read')
   @Get(':id/download')
   async download(@Param('id') id: string, @Res() res: Response): Promise<void> {
     const { buffer, fileName, mimeType } =
@@ -102,7 +104,7 @@ export class DocumentsController {
     res.send(buffer);
   }
 
-  @Roles(Role.ADMIN, Role.BEEKEEPER, Role.STAFF)
+  @RequirePermission('documents:delete')
   @Delete(':id')
   @HttpCode(204)
   delete(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {