fix(admin): P0 integrity — permanent bans, ACL sidebar, rank guards

Co-authored-by: Cursor <[email protected]>

src/actions/admin-bans.ts

@@ -15,8 +15,6 @@ const BAN_TYPES: ReadonlySet<string> = new Set([
 	"machine",
 	"super",
 ]);
-const PERMANENT_SECONDS = 100 * 365 * 24 * 3600;
-
 export async function createBan(formData: FormData): Promise<void> {
 	const staff = await requirePermissionRateLimited(PERMS.USERS_BAN);
 	const userId = Number(formData.get("userId"));
@@ -30,8 +28,8 @@ export async function createBan(formData: FormData): Promise<void> {
 	if (!(userId > 0) || !BAN_TYPES.has(type)) return;
 
 	const now = Math.floor(Date.now() / 1000);
-	const banExpire =
-		hours > 0 ? now + Math.floor(hours) * 3600 : now + PERMANENT_SECONDS;
+	// Emulator convention: banExpire 0 = permanent (not a far-future timestamp).
+	const banExpire = hours > 0 ? now + Math.floor(hours) * 3600 : 0;
 
 	const user = await prisma.user.findUnique({
 		where: { id: userId },