feat(auth): make upload review a separate grant instead of an admin privilege

Reviewing the upload queue is now a per-user flag (reviews_uploads), not part
of the admin role: several people can hold it, a moderator can have it, and an
admin may not. Only admins grant or revoke it; existing admins keep it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/uploads/service.go

@@ -67,7 +67,7 @@ func principal(ctx context.Context, perm auth.Permission) (auth.Principal, error
 	if !ok {
 		return auth.Principal{}, apperr.Unauthorized(auth.CodeUnauthorized, "not authenticated")
 	}
-	if !auth.Can(p.Role, perm) {
+	if !p.Allowed(perm) {
 		return auth.Principal{}, apperr.Forbidden(auth.CodeForbidden, "not allowed")
 	}
 	return p, nil
@@ -425,9 +425,9 @@ func (s *Service) Retry(ctx context.Context, id uuid.UUID) (File, error) {
 	return s.store.File(ctx, id)
 }
 
-// GetSettings — настройки очереди (админ).
+// GetSettings — лимиты очереди (админ, не аудитор загрузок).
 func (s *Service) GetSettings(ctx context.Context) (Settings, error) {
-	if _, err := principal(ctx, auth.PermReviewUploads); err != nil {
+	if _, err := principal(ctx, auth.PermManageLibrary); err != nil {
 		return Settings{}, err
 	}
 	return s.store.Settings(ctx)
@@ -446,7 +446,7 @@ type SettingsInput struct {
 
 // UpdateSettings меняет лимиты; уменьшение ниже занятого ничего не удаляет (docs/uploads.md#3).
 func (s *Service) UpdateSettings(ctx context.Context, in SettingsInput) (Settings, error) {
-	p, err := principal(ctx, auth.PermReviewUploads)
+	p, err := principal(ctx, auth.PermManageLibrary)
 	if err != nil {
 		return Settings{}, err
 	}