feat(auth): make upload review a separate grant instead of an admin privilege

Reviewing the upload queue is now a per-user flag (reviews_uploads), not part
of the admin role: several people can hold it, a moderator can have it, and an
admin may not. Only admins grant or revoke it; existing admins keep it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/auth/admin_handler.go

@@ -44,6 +44,9 @@ func (h *Handler) CreateUser(ctx context.Context, req gen.CreateUserRequestObjec
 		return nil, err
 	}
 	in := CreateUserInput{Username: req.Body.Username, Role: Role(req.Body.Role)}
+	if req.Body.ReviewsUploads != nil {
+		in.ReviewsUploads = *req.Body.ReviewsUploads
+	}
 	if req.Body.DisplayName != nil {
 		in.DisplayName = *req.Body.DisplayName
 	}
@@ -60,7 +63,7 @@ func (h *Handler) UpdateUser(ctx context.Context, req gen.UpdateUserRequestObjec
 	if err != nil {
 		return nil, err
 	}
-	patch := UserPatch{DisplayName: req.Body.DisplayName, IsBlocked: req.Body.IsBlocked}
+	patch := UserPatch{DisplayName: req.Body.DisplayName, IsBlocked: req.Body.IsBlocked, ReviewsUploads: req.Body.ReviewsUploads}
 	if req.Body.Role != nil {
 		r := Role(*req.Body.Role)
 		patch.Role = &r
@@ -147,6 +150,7 @@ func AdminUserDTO(u User) gen.AdminUser {
 		Username:              u.Username,
 		DisplayName:           u.DisplayName,
 		Role:                  gen.Role(u.Role),
+		ReviewsUploads:        u.ReviewsUploads,
 		Locale:                u.Locale,
 		IsBlocked:             u.IsBlocked,
 		MustChangePassword:    u.MustChangePassword,