feat(bookings): restrict management to assigned PIC or super admin

Secure API endpoints with requireBookingManager authorization check
Update confirmation page to prompt for login if unauthorized
Add safe redirect handling to login and guest middleware

server/api/public/bookings/[token]/transaction-document.get.ts

@@ -1,6 +1,7 @@
 import { sendStream, setHeader } from 'h3'
 
-import { getBookingTransactionDocumentByConfirmationToken } from '../../../../utils/booking-repository'
+import { requireBookingManager } from '../../../../utils/auth'
+import { getBookingByConfirmationToken, getBookingTransactionDocumentByConfirmationToken } from '../../../../utils/booking-repository'
 import { getRequiredRouteParam, httpError } from '../../../../utils/http'
 import {
   getSafeDownloadName,
@@ -9,6 +10,14 @@ import {
 
 export default defineEventHandler(async (event) => {
   const token = getRequiredRouteParam(event, 'token', 'Confirmation token')
+  const booking = await getBookingByConfirmationToken(token)
+
+  if (!booking) {
+    httpError(404, 'Booking not found')
+  }
+
+  await requireBookingManager(event, booking)
+
   const document = await getBookingTransactionDocumentByConfirmationToken(token)
 
   if (!document) {