Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/app/admin/rooms/[id]/furni/page.tsx

@@ -84,7 +84,7 @@ export default async function RoomFurniPage({
 					ownerUsername: room.owner?.username ?? room.ownerName,
 				}}
 				items={rows}
-				canEdit={session.user.rank >= 4}
+				canEdit={canAccess(permissions, PERMS.ROOMS_EDIT, session.user.rank)}
 			/>
 		</div>
 	);

src/app/admin/rooms/edit/[id]/page.tsx

@@ -15,10 +15,7 @@ export default async function RoomEditPage({
 }) {
 	const { id } = await params;
 	const { session, permissions } = await getAdminContext();
-	if (
-		!canAccess(permissions, PERMS.ROOMS_VIEW, session.user.rank) ||
-		session.user.rank < 4
-	) {
+	if (!canAccess(permissions, PERMS.ROOMS_EDIT, session.user.rank)) {
 		redirect("/admin");
 	}
 

src/app/admin/rooms/page.tsx

@@ -30,9 +30,7 @@ export default async function RoomsPage({
 		searchParams,
 	);
 
-	const canEdit =
-		canAccess(result.permissions, PERMS.ROOMS_VIEW, result.rank) &&
-		result.rank >= 4;
+	const canEdit = canAccess(result.permissions, PERMS.ROOMS_EDIT, result.rank);
 
 	return (
 		<div className="space-y-6">

src/app/admin/rooms/show/[id]/page.tsx

@@ -29,7 +29,7 @@ export default async function RoomShowPage({
 		redirect("/admin");
 
 	const room = await loadRoom(id);
-	const canEdit = session.user.rank >= 4;
+	const canEdit = canAccess(permissions, PERMS.ROOMS_EDIT, session.user.rank);
 
 	return (
 		<div className="space-y-6">