Extend fine-grained ACL to settings, content, shop, and radio.

Gate pages and mutations on module PERMS instead of dashboard-only staff checks, add radio view/edit slugs with migration 0015, and expand the operations contract tests.

Co-authored-by: Cursor <[email protected]>

src/app/admin/bans/page.tsx

@@ -1,7 +1,9 @@
 import { Ban } from "lucide-react";
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { createBan, liftBan } from "@/actions/admin-bans";
 import { StatusCard } from "@/components/admin/dashboard";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 export const dynamic = "force-dynamic";
@@ -11,6 +13,11 @@ function fromUnix(ts: number): string {
 }
 
 export default async function AdminBans() {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.BANS_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const t = await getTranslations("pages.admin.bans");
 	const now = Math.floor(Date.now() / 1000);
 	let bans: Awaited<ReturnType<typeof prisma.ban.findMany>> = [];