Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-media.ts

@@ -3,14 +3,15 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 
 const MEDIA_DIR = "public/assets/images/media";
 const MAX_SIZE = 5 * 1024 * 1024; // 5MB
 const ALLOWED = ["image/png", "image/jpeg", "image/gif", "image/webp"];
 
 export async function uploadMedia(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.PAGES_EDIT);
 	const file = formData.get("file") as File | null;
 	if (!file || file.size === 0) return;
 	if (file.size > MAX_SIZE) return;
@@ -33,7 +34,7 @@ export async function uploadMedia(formData: FormData): Promise<void> {
 }
 
 export async function deleteMedia(name: string): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.PAGES_EDIT);
 	const { unlink } = await import("node:fs/promises");
 	const baseDir = path.resolve(process.cwd(), MEDIA_DIR);
 	const filePath = path.resolve(baseDir, name);
@@ -50,7 +51,7 @@ export async function deleteMedia(name: string): Promise<void> {
 export async function uploadMediaAndReturn(
 	formData: FormData,
 ): Promise<string> {
-	await requireStaff();
+	await requirePermission(PERMS.PAGES_EDIT);
 	const file = formData.get("file") as File | null;
 	if (!file || file.size === 0) return "";
 	if (file.size > MAX_SIZE) return "";