Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/app/admin/writeable-boxes/page.tsx

@@ -8,12 +8,19 @@ import {
 } from "@/actions/admin-writeable-boxes";
 import { StatusCard } from "@/components/admin/dashboard";
 import { prisma } from "@/lib/prisma";
+import { redirect } from "next/navigation";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 
 export const dynamic = "force-dynamic";
 
 export const metadata = { title: "Writeable boxes" };
 
 export default async function AdminWriteableBoxes() {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.PAGES_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const t = await getTranslations("pages.admin.writeableBoxes");
 	const boxes = await prisma.websiteWriteableBoxes
 		.findMany({