fix(security): authorize site uploads and harden tokens, media and request identity

src/app/(site)/logo/page.tsx

@@ -1,6 +1,7 @@
 import LogoGenerator from "@/components/public/logo-generator";
 import { ContentCard } from "@/components/public/ui";
 import { resolveHotelName } from "@/lib/hotel-name";
+import { canAccess, getApiAdminContext, PERMS } from "@/lib/permissions";
 
 export const metadata = { title: "Logo generator" };
 
@@ -8,10 +9,26 @@ export const metadata = { title: "Logo generator" };
  * Public logo generator (AtomCMS logo-generator.blade). Server wrapper that
  * renders the atom-styled ContentCard header and hands off to the fully
  * client-side <LogoGenerator>, which does all styling, live preview, and PNG
- * export in the browser (no server data, no DB).
+ * export in the browser. Saving the site logo requires settings edit access.
  */
 export default async function LogoPage() {
-	const initialText = await resolveHotelName();
+	const [initialText, context] = await Promise.all([
+		resolveHotelName(),
+		getApiAdminContext(),
+	]);
+	const canSaveToSite = Boolean(
+		context &&
+			canAccess(
+				context.permissions,
+				PERMS.ADMIN_DASHBOARD,
+				context.session.user.rank,
+			) &&
+			canAccess(
+				context.permissions,
+				PERMS.SETTINGS_EDIT,
+				context.session.user.rank,
+			),
+	);
 	return (
 		<main
 			style={{
@@ -27,7 +44,7 @@ export default async function LogoPage() {
 				subtitle="Design a logo for your hotel — pick a font, colours and size, then download it as a PNG."
 			/>
 
-			<LogoGenerator initialText={initialText} />
+			<LogoGenerator initialText={initialText} canSaveToSite={canSaveToSite} />
 		</main>
 	);
 }