Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-writeable-boxes.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
@@ -40,7 +41,7 @@ function revalidate(): void {
 }
 
 export async function createBox(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.PAGES_EDIT);
 
 	const title = String(formData.get("title") ?? "")
 		.normalize("NFC")
@@ -82,7 +83,7 @@ export async function createBox(formData: FormData): Promise<void> {
 }
 
 export async function updateBox(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.PAGES_EDIT);
 
 	const id = parseId(formData);
 	if (id == null) return;
@@ -125,7 +126,7 @@ export async function updateBox(formData: FormData): Promise<void> {
 }
 
 export async function deleteBox(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.PAGES_EDIT);
 
 	const id = parseId(formData);
 	if (id == null) return;
@@ -147,7 +148,7 @@ export async function deleteBox(formData: FormData): Promise<void> {
 }
 
 export async function toggleBox(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.PAGES_EDIT);
 
 	const id = parseId(formData);
 	if (id == null) return;