Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-badge-upload.ts

@@ -3,7 +3,8 @@
 import { writeFile } from "node:fs/promises";
 import path from "node:path";
 import { redirect } from "next/navigation";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
 // Writes a badge image to the configured emulator badge directory. The path is
@@ -20,7 +21,7 @@ function back(param: string, value: string): never {
 }
 
 export async function uploadBadge(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.CATALOG_EDIT);
 
 	const dir = process.env.BADGE_UPLOAD_DIR;
 	if (!dir) {