feat(auth): make upload review a separate grant instead of an admin privilege

Reviewing the upload queue is now a per-user flag (reviews_uploads), not part
of the admin role: several people can hold it, a moderator can have it, and an
admin may not. Only admins grant or revoke it; existing admins keep it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/auth/policy_test.go

@@ -20,7 +20,6 @@ func TestCan(t *testing.T) {
 		{PermManageLibrary, "manage library", [3]bool{false, false, true}},
 		{PermViewLibraryStatus, "library status", [3]bool{false, true, true}},
 		{PermSuggestTracks, "suggest tracks", [3]bool{false, true, true}},
-		{PermReviewUploads, "review uploads", [3]bool{false, false, true}},
 		{PermSystemStatus, "system status", [3]bool{false, false, true}},
 	}
 	roles := [3]Role{RoleUser, RoleModerator, RoleAdmin}
@@ -72,6 +71,14 @@ func TestCanManageUserSelf(t *testing.T) {
 	assert.True(t, CanManageUser(admin, admin, UserResetPassword))
 }
 
+func TestReviewUploadsIsSeparateFromRole(t *testing.T) {
+	assert.False(t, Principal{Role: RoleAdmin}.Allowed(PermReviewUploads))
+	assert.True(t, Principal{Role: RoleModerator, ReviewsUploads: true}.Allowed(PermReviewUploads))
+	assert.True(t, Principal{Role: RoleUser, ReviewsUploads: true}.Allowed(PermReviewUploads))
+	assert.False(t, Principal{Role: RoleUser}.Allowed(PermReviewUploads))
+	assert.True(t, Principal{Role: RoleUser, ReviewsUploads: true}.Allowed(PermSuggestTracks) == false)
+}
+
 func TestCanAssignRole(t *testing.T) {
 	cases := []struct {
 		actor, role Role