feat(scenario): scope baseline reads to planning and cost audiences

packages/api/src/router/scenario.ts

@@ -1,8 +1,9 @@
 import { calculateAllocation } from "@capakraken/engine/allocation";
+import { PermissionKey } from "@capakraken/shared";
 import type { WeekdayAvailability } from "@capakraken/shared";
 import { z } from "zod";
 import { TRPCError } from "@trpc/server";
-import { createTRPCRouter, controllerProcedure, protectedProcedure } from "../trpc.js";
+import { createTRPCRouter, controllerProcedure, planningReadProcedure, requirePermission } from "../trpc.js";
 import { createAuditEntry } from "../lib/audit.js";
 import {
   calculateEffectiveAvailableHours,
@@ -41,9 +42,11 @@ export const scenarioRouter = createTRPCRouter({
   /**
    * Returns current allocations/costs for a project — the baseline for comparison.
    */
-  getProjectBaseline: protectedProcedure
+  getProjectBaseline: planningReadProcedure
     .input(z.object({ projectId: z.string() }))
     .query(async ({ ctx, input }) => {
+      requirePermission(ctx, PermissionKey.VIEW_COSTS);
+
       const project = await ctx.db.project.findUnique({
         where: { id: input.projectId },
         select: {