5f867cd048
CRITICAL: requireRole("manager") + requireSuperUser() stacked = AND logic,
blocking all non-super-user managers from staff CRUD.
Added requireRoleOrSuperUser() OR-guard middleware. Staff write routes now use
the combined guard: manager role OR super-user flag grants access.
Co-Authored-By: Paperclip <noreply@paperclip.ing>