Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/catalog-bc.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -10,7 +11,7 @@ export async function updateBcPage({
 	id,
 	...fields
 }: { id: number } & Record<string, unknown>) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.CATALOG_EDIT);
 	await prisma.catalogPagesBc.update({ where: { id }, data: fields as any });
 	await rcon.updateCatalog();
 	await logStaffActivity({
@@ -25,7 +26,7 @@ export async function updateBcPage({
 }
 
 export async function deleteBcItem({ id }: { id: number }) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.CATALOG_EDIT);
 	await prisma.catalogItemsBc.delete({ where: { id } });
 	await logStaffActivity({
 		staffId: staff.id,
@@ -47,7 +48,7 @@ export async function updateBcItem({
 	orderNumber?: number;
 	extradata?: string;
 }) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.CATALOG_EDIT);
 	await prisma.catalogItemsBc.update({ where: { id }, data: data as any });
 	await logStaffActivity({
 		staffId: staff.id,
@@ -69,7 +70,7 @@ export async function createBcItem({
 	orderNumber: number;
 	extradata: string;
 }) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.CATALOG_EDIT);
 	const created = await prisma.catalogItemsBc.create({
 		data: { pageId, ...data },
 	});
@@ -90,7 +91,7 @@ export async function toggleBcPage({
 	id: number;
 	field: "enabled" | "visible";
 }) {
-	await requireStaff();
+	await requirePermission(PERMS.CATALOG_EDIT);
 	const page = await prisma.catalogPagesBc.findUnique({
 		where: { id },
 		select: { enabled: true, visible: true },
@@ -108,7 +109,7 @@ export async function createBcPage(input: {
 	parentId: number;
 	pageLayout: string;
 }) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.CATALOG_EDIT);
 	const created = await prisma.catalogPagesBc.create({
 		data: {
 			caption: input.caption,