Extend fine-grained ACL to settings, content, shop, and radio.

Gate pages and mutations on module PERMS instead of dashboard-only staff checks, add radio view/edit slugs with migration 0015, and expand the operations contract tests.

Co-authored-by: Cursor <[email protected]>

src/app/admin/theme/page.tsx

@@ -1,3 +1,4 @@
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import {
 	applyCustomTheme,
@@ -7,6 +8,7 @@ import {
 	saveTheme,
 } from "@/actions/admin-theme";
 import { RenameTheme } from "@/components/admin/theme/rename-theme";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { siteSettings } from "@/lib/services/site-settings";
 import { listCustomThemes } from "@/lib/theme-custom-store";
 import { FONTS, PRESETS } from "@/lib/theme-presets";
@@ -317,6 +319,11 @@ export default async function AdminTheme({
 		deletedTheme?: string;
 	}>;
 }) {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.SETTINGS_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const t = await getTranslations("pages.admin.theme");
 
 	const sp = await searchParams;