fix: align permission-gated UI actions

apps/server/src/occupancies/occupancies.controller.spec.ts

@@ -0,0 +1,26 @@
+import 'reflect-metadata';
+import { PERMISSION_KEY } from '../auth/decorators/permission.decorator';
+import { OccupanciesController } from './occupancies.controller';
+
+describe('OccupanciesController permissions', () => {
+  it('requires occupancy:delete for single and batch archive actions', () => {
+    expect(Reflect.getMetadata(PERMISSION_KEY, OccupanciesController.prototype.remove)).toEqual([
+      'occupancy:delete',
+    ]);
+    expect(
+      Reflect.getMetadata(PERMISSION_KEY, OccupanciesController.prototype.batchRemove),
+    ).toEqual(['occupancy:delete']);
+  });
+
+  it('keeps read-only endpoints on occupancy:view', () => {
+    expect(Reflect.getMetadata(PERMISSION_KEY, OccupanciesController.prototype.findAll)).toEqual([
+      'occupancy:view',
+    ]);
+    expect(
+      Reflect.getMetadata(PERMISSION_KEY, OccupanciesController.prototype.exportExcel),
+    ).toEqual(['occupancy:view']);
+    expect(
+      Reflect.getMetadata(PERMISSION_KEY, OccupanciesController.prototype.downloadTemplate),
+    ).toEqual(['occupancy:view']);
+  });
+});