Add curator roles/permissions with Users admin, and fix lineage branch joins.

Staff accounts use admin/curator roles and fine-grained flags; transitions connect source-to-target with color gradients and stream cutout masks so overlaps stay seamless.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/permissions.js

@@ -0,0 +1,41 @@
+/** Fine-grained curator tool permissions. Admins are treated as having all. */
+const ALL_PERMISSIONS = [
+  'images',
+  'checkup',
+  'curator_notes',
+  'translations',
+  'influences',
+  'tours',
+  'users',
+];
+
+function normalizePermissions(raw) {
+  if (!Array.isArray(raw)) return [];
+  const allowed = new Set(ALL_PERMISSIONS);
+  const out = [];
+  for (const key of raw) {
+    if (typeof key === 'string' && allowed.has(key) && !out.includes(key)) {
+      out.push(key);
+    }
+  }
+  return out;
+}
+
+function effectivePermissions(user) {
+  if (!user) return [];
+  if (user.role === 'admin') return [...ALL_PERMISSIONS];
+  return normalizePermissions(user.permissions);
+}
+
+function hasPermission(user, permission) {
+  if (!user || !permission) return false;
+  if (user.role === 'admin') return true;
+  return normalizePermissions(user.permissions).includes(permission);
+}
+
+module.exports = {
+  ALL_PERMISSIONS,
+  normalizePermissions,
+  effectivePermissions,
+  hasPermission,
+};