fix(admin): P0 integrity — permanent bans, ACL sidebar, rank guards

Co-authored-by: Cursor <[email protected]>

src/lib/access-guard.ts

@@ -1,6 +1,7 @@
 import { headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { auth } from "@/lib/auth";
+import { activeBanWhere } from "@/lib/bans";
 import { safeRedirect } from "@/lib/foundation/security";
 import { logger } from "@/lib/logger";
 import { prisma } from "@/lib/prisma";
@@ -62,9 +63,11 @@ export async function enforceSiteAccess(): Promise<void> {
 
 		try {
 			if (!target && session?.user?.id) {
-				const now = Math.floor(Date.now() / 1000);
 				const ban = await prisma.ban.findFirst({
-					where: { userId: Number(session.user.id), banExpire: { gt: now } },
+					where: {
+						userId: Number(session.user.id),
+						...activeBanWhere(),
+					},
 					select: { id: true },
 				});
 				if (ban) target = "/banned";