Extend fine-grained ACL to settings, content, shop, and radio.

Gate pages and mutations on module PERMS instead of dashboard-only staff checks, add radio view/edit slugs with migration 0015, and expand the operations contract tests.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-settings.ts

@@ -1,12 +1,13 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaffRateLimited as requireStaff } from "@/lib/admin/guard";
+import { requirePermissionRateLimited } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 
 export async function updateSetting(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermissionRateLimited(PERMS.SETTINGS_EDIT);
 	const key = String(formData.get("key") ?? "")
 		.normalize("NFC")
 		.trim();
@@ -18,7 +19,7 @@ export async function updateSetting(formData: FormData): Promise<void> {
 }
 
 export async function createSetting(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermissionRateLimited(PERMS.SETTINGS_EDIT);
 	const key = String(formData.get("key") ?? "")
 		.normalize("NFC")
 		.trim()
@@ -39,7 +40,7 @@ export async function createSetting(formData: FormData): Promise<void> {
 }
 
 export async function deleteSetting(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermissionRateLimited(PERMS.SETTINGS_EDIT);
 	const key = String(formData.get("key") ?? "")
 		.normalize("NFC")
 		.trim();