fix(tms): authorize the GraphQL shipment analytics query

The resolver checked that the caller was authenticated and stopped there, so
anyone with a session could read revenue, margin, cost per mile, at-risk loads,
and the customer mix regardless of what their role allowed. It is the path the
client actually uses — the REST analytics handler is the fallback for other
pages — so gating that handler alone left the real door open.

It now requires shipment read, the same gate every other shipment query
carries.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J6ZmrDoHvhoY4zLkcXWwm6

Author: claude