fix(housekeeping): address task 14 review round 1

src/lib/admin-operations-contract.test.ts

@@ -125,7 +125,7 @@ describe("admin operations route contract", () => {
 		expect(source).not.toMatch(/await requireStaffRateLimited\(\)/);
 	});
 
-	it("has no requireStaff left in admin action modules", () => {
+	it("keeps requireStaff only for the approved legacy logo security floor", () => {
 		const dir = "src/actions";
 		const offenders: string[] = [];
 		for (const name of readdirSync(dir)) {
@@ -135,7 +135,7 @@ describe("admin operations route contract", () => {
 				offenders.push(name);
 			}
 		}
-		expect(offenders).toEqual([]);
+		expect(offenders).toEqual(["save-logo.ts"]);
 	});
 
 	it("caches analytics full-scans via redisCache", () => {