Implement account management features in API, including endpoints for listing accounts and updating account roles. Introduce moderator role with associated permissions, and refactor access control checks to accommodate staff roles. Update database schema to support new role constraints and enhance frontend navigation for staff access.

backend/internal/domain/workflow_test.go

@@ -17,6 +17,16 @@ func TestEventWorkflowRejectsStaleVersion(t *testing.T) {
 	}
 }
 
+func TestModeratorIsStaffButNotAdministrator(t *testing.T) {
+	account := Account{Role: RoleModerator}
+	if !account.IsStaff() {
+		t.Fatal("moderator should have operational staff permissions")
+	}
+	if account.IsAdmin() {
+		t.Fatal("moderator must not have administrator role-management permission")
+	}
+}
+
 func TestRosterSwapAndReserveKeepRoleShape(t *testing.T) {
 	roster := testRoster()
 	if err := roster.Swap("a", "a-d1", "b", "b-s1"); !errors.Is(err, ErrInvalid) {
@@ -36,6 +46,35 @@ func TestRosterSwapAndReserveKeepRoleShape(t *testing.T) {
 	}
 }
 
+func TestRosterDragOperationsPreserveEmptyRoleSlots(t *testing.T) {
+	roster := testRoster()
+	roster.Teams[0].CaptainPlayerID = "a-t"
+	if err := roster.MoveToReserve("a", "a-t"); err != nil {
+		t.Fatal(err)
+	}
+	if roster.Teams[0].Slots[0].PlayerID != "" || roster.Teams[0].Slots[0].Role != Tank {
+		t.Fatal("removed tank did not leave an identifiable empty tank slot")
+	}
+	if roster.Teams[0].CaptainPlayerID != "" {
+		t.Fatal("removed captain was retained")
+	}
+	if err := roster.Validate(true); !errors.Is(err, ErrInvalid) {
+		t.Fatalf("incomplete roster was confirmable: %v", err)
+	}
+	if err := roster.PlaceReserve("a", Tank, "reserve", 31); err != nil {
+		t.Fatal(err)
+	}
+	if err := roster.MoveToReserve("b", "b-t"); err != nil {
+		t.Fatal(err)
+	}
+	if err := roster.MoveToEmpty("a", "reserve", "b", Tank); err != nil {
+		t.Fatal(err)
+	}
+	if roster.Teams[1].Slots[0].PlayerID != "reserve" {
+		t.Fatal("dragging into an empty role slot did not move the player")
+	}
+}
+
 func TestSeriesFSMRunsCoinBansAndResult(t *testing.T) {
 	rules := testRules()
 	series, err := NewSeries("series", "event", "", [2]string{"a", "b"}, rules)