fix: re-check canBook() inside export dialog methods (defense in depth)

openExportDialog()/openExportSubscriptionDialog() only guarded on teamId
truthiness, relying solely on the template @if for permission gating.
Every other permission-gated method in Cashbox (submitPlayerBooking,
reverseBooking) re-checks the permission internally too. Add the same
guard here, plus a test asserting direct invocation without booking
rights does not call dialog.open.

myteamwallet_frontend_modern/src/app/features/team/cashbox/cashbox.spec.ts

@@ -306,4 +306,13 @@ describe('Cashbox', () => {
     );
     expect(exportButton).toBeUndefined();
   });
+
+  it('does not open the export dialogs when invoked directly without booking rights', async () => {
+    const { component, dialog } = await setup(1);
+
+    component['openExportDialog']();
+    component['openExportSubscriptionDialog']();
+
+    expect(dialog.open).not.toHaveBeenCalled();
+  });
 });

myteamwallet_frontend_modern/src/app/features/team/cashbox/cashbox.ts

@@ -402,13 +402,13 @@ export class Cashbox {
 
   protected openExportDialog(): void {
     const teamId = this.team()?.id;
-    if (!teamId) return;
+    if (!this.canBook() || !teamId) return;
     this.dialog.open(CashboxExportDialog, { data: { teamId } });
   }
 
   protected openExportSubscriptionDialog(): void {
     const teamId = this.team()?.id;
-    if (!teamId) return;
+    if (!this.canBook() || !teamId) return;
     this.dialog.open(CashboxExportSubscriptionDialog, { data: { teamId } });
   }