feat(admin): reorganize housekeeping and strengthen shared workflows

src/app/admin/layout.tsx

@@ -11,14 +11,9 @@ import { LanguageSwitcher } from "@/components/language-switcher";
 import Link from "@/components/link";
 import { ThemeSwitcher } from "@/components/theme-switcher";
 import { requireStaff } from "@/lib/admin/guard";
-import { collectNavPermissionSlugs } from "@/lib/admin-nav";
-import {
-	ADMIN_NAV_CONFIG_KEY,
-	parseAdminNavConfig,
-} from "@/lib/admin-nav-config";
+import { loadAdminNavigation } from "@/lib/admin/navigation";
 import { db, User } from "@/lib/db";
 import { readCsrfCookieToken } from "@/lib/foundation/security";
-import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { siteSettings } from "@/lib/services/site-settings";
 
 // Request-time auth, existing CSRF cookie, and optional 2FA gate cannot be
@@ -31,6 +26,7 @@ export default async function AdminLayout({
 	children: ReactNode;
 }) {
 	const staff = await requireStaff();
+	const navigation = await loadAdminNavigation();
 	const csrfToken = await readCsrfCookieToken();
 	if (await siteSettings.getBool("force_staff_2fa", false)) {
 		const u = await db
@@ -52,7 +48,7 @@ export default async function AdminLayout({
 					className="flex flex-col min-w-0 p-5 lg:p-6 min-h-full"
 					style={{ backgroundColor: "var(--admin-canvas)" }}
 				>
-					<AdminTopbar staff={staff} />
+					<AdminTopbar staff={staff} navigation={navigation} />
 					<section className="admin-page flex-1">
 						<AdminHubChrome>{children}</AdminHubChrome>
 					</section>
@@ -69,27 +65,8 @@ async function Sidebar({
 }) {
 	const t = await getTranslations("pages.admin.nav");
 	const initial = staff.username.charAt(0).toUpperCase();
-	const { permissions } = await getAdminContext();
-	const isSuperAdmin = permissions.isSuperAdmin;
-	const hasDashboard = canAccess(
-		permissions,
-		PERMS.ADMIN_DASHBOARD,
-		staff.rank,
-	);
-	// Super-admins see everything. Everyone else sees items their ACL grants.
-	// If they can open the admin panel but ACL is incomplete (common after HK→ACL
-	// migration gaps), still show *.view nav entries so categories do not vanish.
-	const allowedPermissions = isSuperAdmin
-		? []
-		: collectNavPermissionSlugs().filter((slug) => {
-				if (canAccess(permissions, slug, staff.rank)) return true;
-				if (!hasDashboard) return false;
-				return slug.endsWith(".view") || slug === PERMS.ADMIN_DASHBOARD;
-			});
-
-	const navConfig = parseAdminNavConfig(
-		await siteSettings.get(ADMIN_NAV_CONFIG_KEY, ""),
-	);
+	const { allowedPermissions, isSuperAdmin, navConfig } =
+		await loadAdminNavigation();
 
 	return (
 		<aside
@@ -118,6 +95,7 @@ async function Sidebar({
 			</div>
 
 			<AdminSidebarNav
+				userId={staff.id}
 				allowedPermissions={allowedPermissions}
 				isSuperAdmin={isSuperAdmin}
 				navConfig={navConfig}