Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/auth/staff_role_defaults_test.go

@@ -0,0 +1,41 @@
+package auth
+
+import "testing"
+
+func TestDefaultStaffRoleAllows(t *testing.T) {
+	t.Parallel()
+	if !DefaultStaffRoleAllows(StaffRoleAdmin, "billing.checkout") {
+		t.Fatal("admin allows all")
+	}
+	if !DefaultStaffRoleAllows(StaffRoleDeveloper, "catalog.vector_categories") {
+		t.Fatal("developer allows debug catalog")
+	}
+	if DefaultStaffRoleAllows(StaffRoleSupportStaff, "billing.checkout") {
+		t.Fatal("support_staff denies billing checkout")
+	}
+	if !DefaultStaffRoleAllows(StaffRoleSupportStaff, "support.center") {
+		t.Fatal("support_staff allows support.center")
+	}
+	if DefaultStaffRoleAllows("", "dashboard.overview") {
+		t.Fatal("unknown role denies")
+	}
+}
+
+func TestStaffRoleAllowsAdminRoute(t *testing.T) {
+	t.Parallel()
+	if !StaffRoleAllowsAdminRoute(StaffRoleAdmin, "/admin/billing") {
+		t.Fatal("admin billing")
+	}
+	if StaffRoleAllowsAdminRoute(StaffRoleSupportStaff, "/admin/billing") {
+		t.Fatal("support_staff no billing")
+	}
+	if !StaffRoleAllowsAdminRoute(StaffRoleSupportStaff, "/admin/support") {
+		t.Fatal("support_staff support queue")
+	}
+	if StaffRoleFromPlatformAdmin(true) != StaffRoleAdmin {
+		t.Fatal("platform admin maps to admin")
+	}
+	if StaffRoleFromPlatformAdmin(false) != "" {
+		t.Fatal("non-admin maps empty")
+	}
+}