Extend fine-grained ACL to settings, content, shop, and radio.

Gate pages and mutations on module PERMS instead of dashboard-only staff checks, add radio view/edit slugs with migration 0015, and expand the operations contract tests.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-radio-autodj.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
@@ -51,7 +52,7 @@ function optUInt(raw: FormDataEntryValue | null): number | null {
 // ── AutoDJ playlist CRUD (radio_auto_dj_playlist) ────────────────────────
 
 export async function createTrack(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 	const title = str(formData.get("title")).trim().slice(0, 255);
 	if (!title) return;
 
@@ -91,7 +92,7 @@ export async function createTrack(formData: FormData): Promise<void> {
 }
 
 export async function toggleTrack(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 
@@ -117,7 +118,7 @@ export async function toggleTrack(formData: FormData): Promise<void> {
 }
 
 export async function deleteTrack(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;