Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-housekeeping.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 /**
@@ -9,7 +10,7 @@ import { prisma } from "@/lib/prisma";
  * string). Mirrors AtomCMS' housekeeping permission management.
  */
 export async function upsertPermission(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SETTINGS_EDIT);
 
 	const permission = String(formData.get("permission") ?? "")
 		.normalize("NFC")
@@ -38,7 +39,7 @@ export async function upsertPermission(formData: FormData): Promise<void> {
 }
 
 export async function deletePermission(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SETTINGS_EDIT);
 
 	const raw = String(formData.get("id") ?? "").normalize("NFC");
 	if (!raw) return;