feat(auth): make upload review a separate grant instead of an admin privilege

Reviewing the upload queue is now a per-user flag (reviews_uploads), not part
of the admin role: several people can hold it, a moderator can have it, and an
admin may not. Only admins grant or revoke it; existing admins keep it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/auth/admin_test.go

@@ -395,3 +395,28 @@ func TestAudit(t *testing.T) {
 	mod := e.signIn("mod", "moderator-pass-1")
 	assert.Equal(t, auth.CodeForbidden, e.do(http.MethodGet, "/api/v1/admin/audit", nil, bearer(mod)).code())
 }
+
+// Аудит загрузок выдаёт только админ, и он не следует из роли.
+func TestReviewUploadsGrant(t *testing.T) {
+	e := newEnv(t)
+	e.addUser("root", "root-password-1", auth.RoleAdmin)
+	admin := e.signIn("root", "root-password-1")
+	target := e.addUser("mod", "mod-password-1", auth.RoleModerator)
+	mod := e.signIn("mod", "mod-password-1")
+	path := "/api/v1/admin/users/" + target.ID.String()
+	grant := map[string]any{"reviews_uploads": true}
+
+	me := e.do(http.MethodGet, "/api/v1/me", nil, bearer(admin))
+	assert.Equal(t, false, me.body["reviews_uploads"])
+
+	assert.Equal(t, auth.CodeForbidden, e.do(http.MethodPatch, path, grant, bearer(mod)).code())
+	assert.Equal(t, auth.CodeForbidden, e.do(http.MethodPost, "/api/v1/admin/users",
+		map[string]any{"username": "rev", "role": "user", "reviews_uploads": true}, bearer(mod)).code())
+
+	r := e.do(http.MethodPatch, path, grant, bearer(admin))
+	require.Equal(t, http.StatusOK, r.Code, r.Body.String())
+	assert.Equal(t, true, r.body["reviews_uploads"])
+	assert.Equal(t, "moderator", r.body["role"])
+	me = e.do(http.MethodGet, "/api/v1/me", nil, bearer(mod))
+	assert.Equal(t, true, me.body["reviews_uploads"])
+}