fix(housekeeping): close final authorization gaps

src/lib/admin-operations-contract.test.ts

@@ -38,7 +38,7 @@ describe("administration backend contract", () => {
 		expect(source).not.toMatch(/await requireStaffRateLimited\(\)/);
 	});
 
-	it("keeps requireStaff only for the approved legacy logo security floor", () => {
+	it("requires explicit permissions for every administration action", () => {
 		const dir = "src/actions";
 		const offenders: string[] = [];
 		for (const name of readdirSync(dir)) {
@@ -48,7 +48,7 @@ describe("administration backend contract", () => {
 				offenders.push(name);
 			}
 		}
-		expect(offenders).toEqual(["save-logo.ts"]);
+		expect(offenders).toEqual([]);
 	});
 
 	it("keeps the shared ops health probe behind the API", () => {