fix(server-transfer): require update access to export bundles

app/Livewire/Server/Transfer.php

@@ -86,7 +86,7 @@ class Transfer extends Component
         $this->ensureDevelopmentAvailability();
 
         try {
-            $this->authorize('view', $this->server);
+            $this->authorize('update', $this->server);
             if ($this->isLocalhost) {
                 throw new \RuntimeException('The Coolify host (localhost) cannot be transferred.');
             }

tests/Feature/Livewire/ServerTransferUiTest.php

@@ -100,6 +100,17 @@ test('export bundle streams download from livewire', function () {
         ->assertFileDownloaded('server-transfer-'.$this->server->uuid.'.json');
 });
 
+test('team members cannot export a transfer bundle', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Transfer::class, ['server_uuid' => $this->server->uuid])
+        ->call('exportBundle')
+        ->assertNoFileDownloaded();
+});
+
 test('transfer page badge shows the management state of the server', function (string $state, string $label, array $hidden) {
     $claimer = app(ServerTransferClaimer::class);
     match ($state) {