Add a read-only role per app for calendar, feedback and tickets

A grant can now be `read` instead of `access`: requireAppAccess lets it
through for GET/HEAD/OPTIONS and answers 403 to every other method, so
new write routes are covered without being marked. `read` and `access`
on the same app are rejected together; user management has no read role.
/tickets/admin/me and /feedback/admin/me report `readOnly`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/admin/admin.middleware.test.ts

@@ -15,7 +15,7 @@ import {requireAppAccess, requireSignedIn, resolveAccess} from '../../src/models
 const mockGetSession = auth.api.getSession as unknown as Mock;
 const mockLoadAccess = UsersService.loadAccess as Mock;
 
-const makeReq = (): Request => ({headers: {cookie: 'nachklang.session_token=abc'}} as unknown as Request);
+const makeReq = (method = 'GET'): Request => ({method, headers: {cookie: 'nachklang.session_token=abc'}} as unknown as Request);
 
 const makeRes = (): Response => {
 	const res: any = {};
@@ -219,4 +219,62 @@ describe('requireAppAccess', () => {
 
 		expect(next).toHaveBeenCalled();
 	});
+
+	describe('read-only grant', () => {
+		const readOnlyUser = {
+			...activeUser,
+			permissions: [{app: 'tickets', role: 'read'}],
+			apps: ['tickets']
+		};
+
+		it.each(['GET', 'HEAD', 'OPTIONS'])('lets %s through', async method => {
+			mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+			mockLoadAccess.mockResolvedValue(readOnlyUser);
+			const res = makeRes();
+			const next = vi.fn();
+
+			await requireAppAccess('tickets')(makeReq(method), res, next);
+
+			expect(next).toHaveBeenCalled();
+		});
+
+		it.each(['POST', 'PUT', 'PATCH', 'DELETE'])('403s %s', async method => {
+			mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+			mockLoadAccess.mockResolvedValue(readOnlyUser);
+			const res = makeRes();
+			const next = vi.fn();
+
+			await requireAppAccess('tickets')(makeReq(method), res, next);
+
+			expect(res.status).toHaveBeenCalledWith(403);
+			expect(res.send).toHaveBeenCalledWith(expect.objectContaining({message: 'Du hast für diesen Bereich nur Lesezugriff.'}));
+			expect(next).not.toHaveBeenCalled();
+		});
+
+		it('does not let full access to another app write here', async () => {
+			mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+			mockLoadAccess.mockResolvedValue({
+				...activeUser,
+				permissions: [{app: 'tickets', role: 'read'}, {app: 'feedback', role: 'access'}],
+				apps: ['feedback', 'tickets']
+			});
+			const res = makeRes();
+			const next = vi.fn();
+
+			await requireAppAccess('tickets')(makeReq('POST'), res, next);
+
+			expect(res.status).toHaveBeenCalledWith(403);
+		});
+
+		it('lets full access write', async () => {
+			mockGetSession.mockResolvedValue({user: {id: 'u1'}});
+			mockLoadAccess.mockResolvedValue(activeUser);
+			const res = makeRes();
+			const next = vi.fn();
+
+			await requireAppAccess('feedback')(makeReq('DELETE'), res, next);
+
+			expect(next).toHaveBeenCalled();
+		});
+	});
 });