fix: re-check canBook() inside export dialog methods (defense in depth)

openExportDialog()/openExportSubscriptionDialog() only guarded on teamId
truthiness, relying solely on the template @if for permission gating.
Every other permission-gated method in Cashbox (submitPlayerBooking,
reverseBooking) re-checks the permission internally too. Add the same
guard here, plus a test asserting direct invocation without booking
rights does not call dialog.open.

myteamwallet_frontend_modern/src/app/features/team/cashbox/cashbox.ts

@@ -402,13 +402,13 @@ export class Cashbox {
 
   protected openExportDialog(): void {
     const teamId = this.team()?.id;
-    if (!teamId) return;
+    if (!this.canBook() || !teamId) return;
     this.dialog.open(CashboxExportDialog, { data: { teamId } });
   }
 
   protected openExportSubscriptionDialog(): void {
     const teamId = this.team()?.id;
-    if (!teamId) return;
+    if (!this.canBook() || !teamId) return;
     this.dialog.open(CashboxExportSubscriptionDialog, { data: { teamId } });
   }