Extend fine-grained ACL to settings, content, shop, and radio.

Gate pages and mutations on module PERMS instead of dashboard-only staff checks, add radio view/edit slugs with migration 0015, and expand the operations contract tests.

Co-authored-by: Cursor <[email protected]>

src/app/admin/radio/embed/page.tsx

@@ -2,7 +2,6 @@ import { Code } from "lucide-react";
 import Link from "next/link";
 import { getTranslations } from "next-intl/server";
 import { StatusCard } from "@/components/admin/dashboard";
-import { requireStaff } from "@/lib/admin/guard";
 import { siteSettings } from "@/lib/services/site-settings";
 import { EmbedSnippet } from "./embed-snippet";
 
@@ -11,8 +10,6 @@ export const dynamic = "force-dynamic";
 export const metadata = { title: "Radio Embed" };
 
 export default async function AdminRadioEmbedPage() {
-	await requireStaff();
-
 	const t = await getTranslations("pages.admin.radio");
 
 	let streamUrl = "";

src/app/admin/radio/layout.tsx

@@ -0,0 +1,15 @@
+import { redirect } from "next/navigation";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
+
+export default async function RadioAdminLayout({
+	children,
+}: {
+	children: React.ReactNode;
+}) {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.RADIO_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
+	return children;
+}

src/app/admin/radio/monitoring/page.tsx

@@ -2,7 +2,6 @@ import { Radio } from "lucide-react";
 import Link from "next/link";
 import { getTranslations } from "next-intl/server";
 import { DiagnosticRow, StatusCard } from "@/components/admin/dashboard";
-import { requireStaff } from "@/lib/admin/guard";
 import { siteSettings } from "@/lib/services/site-settings";
 
 export const dynamic = "force-dynamic";
@@ -166,8 +165,6 @@ function shortUrl(url: string): string {
 }
 
 export default async function AdminRadioMonitoringPage() {
-	await requireStaff();
-
 	const t = await getTranslations("pages.admin.radio");
 
 	let nowPlayingUrl: string | null = null;