feat(auth): make upload review a separate grant instead of an admin privilege

Reviewing the upload queue is now a per-user flag (reviews_uploads), not part
of the admin role: several people can hold it, a moderator can have it, and an
admin may not. Only admins grant or revoke it; existing admins keep it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/auth/authtest/memstore.go

@@ -303,6 +303,9 @@ func (s *MemStore) UpdateUser(ctx context.Context, id uuid.UUID, upd auth.UserUp
 		if upd.IsBlocked != nil {
 			u.IsBlocked = *upd.IsBlocked
 		}
+		if upd.ReviewsUploads != nil {
+			u.ReviewsUploads = *upd.ReviewsUploads
+		}
 		if upd.RevokeTokens {
 			u.TokenVersion++
 		}