Merge branch 'main' into #43-vacation-summary-for-employee

# Conflicts:
#	app/Infrastructure/Http/Controllers/HolidayController.php
#	app/Infrastructure/Http/Controllers/VacationLimitController.php
#	app/Infrastructure/Http/Controllers/VacationRequestController.php
#	composer.lock
#	resources/js/Pages/Holidays/Index.vue
#	resources/js/Pages/VacationRequest/Create.vue

app/Infrastructure/Http/Controllers/HolidayController.php

@@ -4,7 +4,9 @@ declare(strict_types=1);
 
 namespace Toby\Infrastructure\Http\Controllers;
 
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
 use Inertia\Response;
 use Toby\Eloquent\Helpers\YearPeriodRetriever;
 use Toby\Eloquent\Models\Holiday;
@@ -14,7 +16,7 @@ use Toby\Infrastructure\Http\Resources\HolidayResource;
 
 class HolidayController extends Controller
 {
-    public function index(YearPeriodRetriever $yearPeriodRetriever): Response
+    public function index(Request $request, YearPeriodRetriever $yearPeriodRetriever): Response
     {
         $yearPeriod = $yearPeriodRetriever->selected();
 
@@ -25,16 +27,29 @@ class HolidayController extends Controller
 
         return inertia("Holidays/Index", [
             "holidays" => HolidayResource::collection($holidays),
+            "can" => [
+                "manageHolidays" => $request->user()->can("manageHolidays"),
+            ],
         ]);
     }
 
+    /**
+     * @throws AuthorizationException
+     */
     public function create(): Response
     {
+        $this->authorize("manageHolidays");
+
         return inertia("Holidays/Create");
     }
 
+    /**
+     * @throws AuthorizationException
+     */
     public function store(HolidayRequest $request): RedirectResponse
     {
+        $this->authorize("manageHolidays");
+
         Holiday::query()->create($request->data());
 
         return redirect()
@@ -42,15 +57,25 @@ class HolidayController extends Controller
             ->with("success", __("Holiday has been created."));
     }
 
+    /**
+     * @throws AuthorizationException
+     */
     public function edit(Holiday $holiday): Response
     {
+        $this->authorize("manageHolidays");
+
         return inertia("Holidays/Edit", [
             "holiday" => new HolidayFormDataResource($holiday),
         ]);
     }
 
+    /**
+     * @throws AuthorizationException
+     */
     public function update(HolidayRequest $request, Holiday $holiday): RedirectResponse
     {
+        $this->authorize("manageHolidays");
+
         $holiday->update($request->data());
 
         return redirect()
@@ -58,8 +83,13 @@ class HolidayController extends Controller
             ->with("success", __("Holiday has been updated."));
     }
 
+    /**
+     * @throws AuthorizationException
+     */
     public function destroy(Holiday $holiday): RedirectResponse
     {
+        $this->authorize("manageHolidays");
+
         $holiday->delete();
 
         return redirect()