feat(auth): make upload review a separate grant instead of an admin privilege

Reviewing the upload queue is now a per-user flag (reviews_uploads), not part
of the admin role: several people can hold it, a moderator can have it, and an
admin may not. Only admins grant or revoke it; existing admins keep it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/openapi.yaml

@@ -2176,7 +2176,7 @@ components:
           type: boolean
     Me:
       type: object
-      required: [id, username, display_name, role, locale, ui_prefs, must_change_password, must_change_credentials, created_at]
+      required: [id, username, display_name, role, reviews_uploads, locale, ui_prefs, must_change_password, must_change_credentials, created_at]
       properties:
         id:
           type: string
@@ -2188,6 +2188,9 @@ components:
           nullable: true
         role:
           $ref: "#/components/schemas/Role"
+        reviews_uploads:
+          type: boolean
+          description: Может рассматривать очередь на добавление. Не следует из роли и может быть у нескольких людей сразу
         locale:
           type: string
         ui_prefs:
@@ -2228,7 +2231,7 @@ components:
           type: string
     AdminUser:
       type: object
-      required: [id, username, display_name, role, locale, is_blocked, must_change_password, must_change_credentials, created_at, last_login_at]
+      required: [id, username, display_name, role, reviews_uploads, locale, is_blocked, must_change_password, must_change_credentials, created_at, last_login_at]
       properties:
         id:
           type: string
@@ -2240,6 +2243,9 @@ components:
           nullable: true
         role:
           $ref: "#/components/schemas/Role"
+        reviews_uploads:
+          type: boolean
+          description: Может рассматривать очередь на добавление. Не следует из роли и может быть у нескольких людей сразу
         locale:
           type: string
         is_blocked:
@@ -2277,6 +2283,9 @@ components:
           maxLength: 64
         role:
           $ref: "#/components/schemas/Role"
+        reviews_uploads:
+          type: boolean
+          description: Сразу выдать аудит загрузок. Может задать только админ
     CreatedUser:
       type: object
       required: [user, temporary_password]
@@ -2297,6 +2306,9 @@ components:
           $ref: "#/components/schemas/Role"
         is_blocked:
           type: boolean
+        reviews_uploads:
+          type: boolean
+          description: Выдать или забрать аудит загрузок. Может менять только админ, в том числе у себя
     TemporaryPassword:
       type: object
       required: [temporary_password]