feat(auth): make upload review a separate grant instead of an admin privilege

Reviewing the upload queue is now a per-user flag (reviews_uploads), not part
of the admin role: several people can hold it, a moderator can have it, and an
admin may not. Only admins grant or revoke it; existing admins keep it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/auth/service.go

@@ -368,6 +368,7 @@ func (s *Service) Authenticate(ctx context.Context, access string) (Principal, e
 	return Principal{
 		UserID:                u.ID,
 		Role:                  u.Role,
+		ReviewsUploads:        u.ReviewsUploads,
 		SessionID:             claims.SessionID,
 		MustChangePassword:    u.MustChangePassword,
 		MustChangeCredentials: u.MustChangeCredentials,
@@ -621,7 +622,7 @@ func (s *Service) Bootstrap(ctx context.Context) error {
 	}
 	u := User{
 		ID: s.ids.New(), Username: username, PasswordHash: hash, Role: RoleAdmin, Locale: "ru",
-		MustChangeCredentials: true, CreatedAt: s.clock.Now(),
+		ReviewsUploads: true, MustChangeCredentials: true, CreatedAt: s.clock.Now(),
 	}
 	err = s.store.WithTx(ctx, func(tx Store) error {
 		if err := tx.CreateUser(ctx, u, nil); err != nil {