fix: enforce public contrast and audit rank errors

src/lib/permissions.ts

@@ -4,6 +4,7 @@ import { cache } from 'react'
 import { auth } from './auth'
 import { sessionUserId } from './auth/session-user'
 import { prisma } from './prisma'
+import { logAuthorizationEvent } from './admin/authorization-events'
 
 // Re-export PERMS from the standalone file (safe for client components)
 export { PERMS } from './permission-slugs'
@@ -82,7 +83,8 @@ export const loadUserPermissions = cache(async function loadUserPermissions(
       hasAll: (...perms: string[]) => perms.every((p) => slugs.has(p)),
       isSuperAdmin: false,
     }
-  } catch {
+  } catch (error) {
+    await logAuthorizationEvent({ kind: 'permission.load_error', userId, rank, source: 'loadUserPermissions', reason: 'ACL query failed', error })
     // Fail-closed: return empty set on any error
     return createEmptySet()
   }