Fix admin permissions bounce, prefixes APIs, and Italian UI leftovers.

Gate permissions on ACL manage + resolve super-admin from live user ranks, restore prefixes API routes, and anglicize hardcoded admin copy with nav i18n.

Co-authored-by: Cursor <[email protected]>

src/app/api/admin/prefixes/blacklist/route.ts

@@ -0,0 +1,48 @@
+import { withAdmin } from "@/lib/api-handler";
+import { apiError, apiOk } from "@/lib/api-response";
+import { PERMS } from "@/lib/permissions";
+import { prisma } from "@/lib/prisma";
+
+interface BlacklistWord {
+	id: number;
+	word: string;
+}
+
+export const GET = withAdmin({ permission: PERMS.PREFIXES_VIEW }, async () => {
+	const words = await prisma.$queryRaw<BlacklistWord[]>`
+    SELECT id, word FROM custom_prefix_blacklist ORDER BY word ASC
+  `;
+
+	return apiOk({
+		words: words.map((w) => ({ ...w, created_at: "" })),
+	});
+});
+
+export const POST = withAdmin(
+	{ permission: PERMS.PREFIXES_EDIT },
+	async (request) => {
+		const body = await request.json();
+		const word = typeof body.word === "string" ? body.word.trim() : "";
+
+		if (!word) return apiError("Word is required");
+
+		await prisma.$executeRaw`INSERT INTO custom_prefix_blacklist (word) VALUES (${word})`;
+
+		return apiOk();
+	},
+);
+
+export const DELETE = withAdmin(
+	{ permission: PERMS.PREFIXES_EDIT },
+	async (request) => {
+		const body = await request.json();
+		const id = Number(body.id);
+
+		if (!Number.isInteger(id) || id <= 0)
+			return apiError("Missing or invalid word id");
+
+		await prisma.$executeRaw`DELETE FROM custom_prefix_blacklist WHERE id = ${id}`;
+
+		return apiOk({ deleted: id });
+	},
+);