Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-ads.ts

@@ -2,7 +2,8 @@
 
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -11,7 +12,7 @@ import { logStaffActivity } from "@/lib/services/staff-activity";
 // table; it only stores an image URL rendered in the site layout/widgets.
 
 export async function createAd(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.PAGES_EDIT);
 	const image = String(formData.get("image") ?? "")
 		.normalize("NFC")
 		.trim()
@@ -39,7 +40,7 @@ export async function createAd(formData: FormData): Promise<void> {
 }
 
 export async function updateAd(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.PAGES_EDIT);
 	const raw = String(formData.get("id") ?? "").normalize("NFC");
 	if (!/^\d+$/.test(raw)) return;
 	const id = BigInt(raw);
@@ -70,7 +71,7 @@ export async function updateAd(formData: FormData): Promise<void> {
 }
 
 export async function deleteAd(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.PAGES_EDIT);
 	const id = formPositiveBigInt(formData, "id");
 	if (!id) return;