Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-rare-values.ts

@@ -1,12 +1,13 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { prisma } from "@/lib/prisma";
 
 export async function createCategory(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SHOP_EDIT);
 	const name = String(formData.get("name") ?? "")
 		.normalize("NFC")
 		.trim()
@@ -33,7 +34,7 @@ export async function createCategory(formData: FormData): Promise<void> {
 }
 
 export async function deleteCategory(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SHOP_EDIT);
 	const id = formPositiveBigInt(formData, "id");
 	if (!id) return;
 
@@ -48,7 +49,7 @@ export async function deleteCategory(formData: FormData): Promise<void> {
 }
 
 export async function createValue(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SHOP_EDIT);
 	const categoryId = formPositiveBigInt(formData, "categoryId");
 	if (!categoryId) return;
 
@@ -98,7 +99,7 @@ export async function createValue(formData: FormData): Promise<void> {
 }
 
 export async function deleteValue(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SHOP_EDIT);
 	const id = formPositiveBigInt(formData, "id");
 	if (!id) return;