feat(auth): make upload review a separate grant instead of an admin privilege

Reviewing the upload queue is now a per-user flag (reviews_uploads), not part
of the admin role: several people can hold it, a moderator can have it, and an
admin may not. Only admins grant or revoke it; existing admins keep it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/auth/model.go

@@ -54,6 +54,7 @@ type User struct {
 	DisplayName           *string
 	PasswordHash          string
 	Role                  Role
+	ReviewsUploads        bool // аудит очереди на добавление; не следует из роли
 	Locale                string
 	UIPrefs               UIPrefs
 	MustChangePassword    bool
@@ -94,6 +95,7 @@ type Session struct {
 type Principal struct {
 	UserID                uuid.UUID
 	Role                  Role
+	ReviewsUploads        bool
 	SessionID             uuid.UUID
 	MustChangePassword    bool
 	MustChangeCredentials bool