Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-help.ts

@@ -2,7 +2,8 @@
 
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -16,7 +17,7 @@ function parsePosition(value: FormDataEntryValue | null): number {
 }
 
 export async function createHelpQuestion(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.PAGES_EDIT);
 	const name = String(formData.get("name") ?? "")
 		.normalize("NFC")
 		.trim()
@@ -82,7 +83,7 @@ export async function createHelpQuestion(formData: FormData): Promise<void> {
 }
 
 export async function updateHelpQuestion(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.PAGES_EDIT);
 	const id = formPositiveBigInt(formData, "id");
 	if (!id) return;
 
@@ -149,7 +150,7 @@ export async function updateHelpQuestion(formData: FormData): Promise<void> {
 }
 
 export async function deleteHelpQuestion(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.PAGES_EDIT);
 	const id = formPositiveBigInt(formData, "id");
 	if (!id) return;