fix: correct the ACL revoke migration and update the login redirect e2e

The deploy gate found two defects in the previous commits, both mine.

0034_acl_midrank_revoke.sql never applied: it joined `acl_roles` on
`ar.model_type`, a column that table does not have (only
`acl_model_permissions` does). It now joins on the id and keeps the
`model_type` check where it belongs.

That hid a second, worse bug. The rank was extracted with
`SUBSTRING(slug, 7)`, but MySQL's SUBSTRING is 1-based and the digits start at
position 6, right after `rank_`. rank_10 therefore parsed as 0 and rank_7 as an
empty string, so every rank >= 7 would have lost exactly the grants the
migration exists to preserve — the ACL repair would have made things worse, not
better. Now reads from position 6.

Verified against a real MariaDB with a fixture covering rank_1, rank_6, rank_7,
rank_9, rank_10 and a non-rank slug: only the sub-7 roles lose their non-view
admin.* grants, the multi-digit and higher ranks keep everything, and the
non-rank slug is untouched. The mail index was checked the same way — it
applies idempotently and EXPLAIN confirms `users_mail_index` with rows: 1.

news.spec.ts expected to land on /me after signing in. That expectation predates
the `?from=` honouring added in 39332149, which lands a bounced admin back where
they were heading. The same step navigates to /admin/articles/new explicitly a
few lines later, so nothing depended on it; the assertion now covers the redirect
target instead.

e2e/news-real/news.spec.ts

@@ -88,7 +88,10 @@ test("staff signs in, saves a draft, previews it and publishes to anonymous read
 			await page
 				.locator('input[autocomplete="current-password"]')
 				.press("Enter");
-			await expect(page).toHaveURL(/\/me(?:\?|$)/);
+			// The login page honours `?from=`, so an admin bounced off /admin lands
+			// back where they were heading instead of on /me. The step below
+			// navigates there explicitly anyway; this asserts the redirect target.
+			await expect(page).toHaveURL(/\/admin\/articles\/new(?:\?|$)/);
 			const session = await context.request
 				.get("/api/auth/session")
 				.then((response) => response.json());