feat(auth): make upload review a separate grant instead of an admin privilege

Reviewing the upload queue is now a per-user flag (reviews_uploads), not part
of the admin role: several people can hold it, a moderator can have it, and an
admin may not. Only admins grant or revoke it; existing admins keep it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/uploads/handler.go

@@ -53,7 +53,7 @@ func (h *Handler) fileDTO(ctx context.Context, f File) gen.UploadFile {
 		out.TusUrl = &u
 	}
 	if h.signer != nil && f.StagingPath != "" && f.Status.KeepsStaging() {
-		if p, ok := auth.PrincipalFrom(ctx); ok && auth.Can(p.Role, auth.PermReviewUploads) {
+		if p, ok := auth.PrincipalFrom(ctx); ok && p.ReviewsUploads {
 			u := h.streamURL(f.ID)
 			out.StreamUrl = &u
 		}