admin: per-area permissions on every route

Give each user independent read, write and delete flags per area
(invoices, bingo, users), so someone can e.g. review and remove bingo
incidents without being able to add any. The request method and path
decide the flag needed: GET is read except the new/duplicate forms, POST
to .../delete is delete, any other POST is write. Unmapped admin paths
are superuser-only, and a test enumerates every registered admin route
so a new one cannot ship without a rule.

Pages follow the same flags: nav and dashboard tiles show readable areas
only, write forms and delete buttons are hidden, and the datacenter form
is shown read-only.

Assisted-by: Claude:opus-5

views/admin/bingo/index.erb

@@ -8,6 +8,7 @@
 
 <% if @flash %><div class="form-error-base"><div><%= @flash %></div></div><% end %>
 
+<% if can?('bingo', 'write') %>
 <section class="section">
     <h2>Record incident</h2>
     <form class="invoice-form" method="post" action="/admin/bingo/incidents" autocomplete="off">
@@ -37,6 +38,7 @@
         <button type="submit" class="download-button">Cross it out</button>
     </form>
 </section>
+<% end %>
 
 <section class="section">
     <h2>Incidents</h2>
@@ -53,10 +55,12 @@
                         <td><%= Bingo::ICONS[i.kind] %> <%= i.kind %></td>
                         <td><% if i.url %><a href="<%= i.url %>" target="_blank" rel="noopener"><%= i.title_ru %></a><% else %><%= i.title_ru %><% end %></td>
                         <td class="actions">
+                            <% if can?('bingo', 'delete') %>
                             <form method="post" action="/admin/bingo/incidents/<%= i.id %>/delete" onsubmit="return confirm('Delete this incident?')">
                                 <input type="hidden" name="authenticity_token" value="<%= csrf_token %>" />
                                 <button type="submit" class="link-button">delete</button>
                             </form>
+                            <% end %>
                         </td>
                     </tr>
                 <% end %>
@@ -67,6 +71,7 @@
 
 <section class="section">
     <h2>Card</h2>
+    <% if can?('bingo', 'write') %>
     <p><a href="/admin/bingo/dc/new">+ Add datacenter</a> · positions 1–<%= Bingo::SIZE**2 %> are on the card, the rest are reserve</p>
     <form method="post" action="/admin/bingo/sort" onsubmit="return confirm('Re-rank every datacenter by MW? Manual ordering is lost.')">
         <input type="hidden" name="authenticity_token" value="<%= csrf_token %>" />
@@ -85,6 +90,9 @@
         <input type="hidden" name="all" value="1" />
         <button type="submit" class="link-button">↻ Re-import all photos from their source URLs</button>
     </form>
+    <% else %>
+    <p class="optional">Positions 1–<%= Bingo::SIZE**2 %> are on the card, the rest are reserve.</p>
+    <% end %>
     <table class="invoice-list">
         <thead><tr><th>#</th><th>Photo</th><th>Name</th><th>Operator</th><th class="num">MW</th><th>Status</th><th class="num">Incidents</th><th></th></tr></thead>
         <tbody>
@@ -100,7 +108,7 @@
                     <td class="num mono"><%= dc.mw %><%= " #{dc.mw_type}" if dc.mw_type %></td>
                     <td><%= dc.status %></td>
                     <td class="num mono"><%= dc.incidents.size %></td>
-                    <td class="actions"><a href="/admin/bingo/dc/<%= dc.id %>">edit</a></td>
+                    <td class="actions"><a href="/admin/bingo/dc/<%= dc.id %>"><%= can?('bingo', 'write') ? 'edit' : 'view' %></a></td>
                 </tr>
             <% end %>
         </tbody>