fix: let a read-only account sign out

A React server action POSTs to the URL of the page it lives on, so the
middleware's method check over /admin refused every form on the site to
a viewer — including the sign-out button, which surfaced as "an
unexpected response was received from the server".

Gating pages by HTTP method was the wrong instrument: at the edge there
is no way to tell a form that changes the shop's hours from one that
ends a session. The method check now applies to /api/admin only, and
page-level writes are authorised inside the actions themselves, where
the intent is actually known. lib/auth/actions.ts carries that check and
returns an error rather than throwing, since "you do not have
permission" is a normal outcome and not a crash.

The edge decision moves into a pure function with a regression test for
this exact case. These rules are short, but they are the only thing in
front of the administration and one of them has now been got wrong once.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012cSY9pVhZmJUKNN7wf1Myd

middleware.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server';
 
+import { decideAccess } from '@/lib/auth/access';
 import { auth } from '@/lib/auth';
 
 /**
@@ -10,33 +11,32 @@ import { auth } from '@/lib/auth';
  * screen; API routes get a status code, because a fetch that receives an HTML
  * login page is a confusing way to learn you are signed out.
  *
- * Write access is enforced here too: a `viewer` may read anything and change
- * nothing. Doing it at the edge means a read-only account cannot reach a
- * handler that mutates, whatever that handler remembers to check.
+ * Write access is enforced here for /api/admin only, and deliberately NOT for
+ * pages. A React server action POSTs to the URL of the page it lives on, so a
+ * method check over /admin would refuse every form on the site to a read-only
+ * account — including the sign-out button, which is not a write by any useful
+ * definition. Page-level write protection belongs inside the actions
+ * themselves, via lib/auth/actions.ts, where the intent is actually known.
  *
  * The device API (/api/setup, /api/display, /api/log) is deliberately outside
  * this matcher: the panel cannot sign in, and carries its own bearer token.
  */
 export default auth((request) => {
   const { pathname } = request.nextUrl;
-  const isApi = pathname.startsWith('/api/admin');
-  const session = request.auth;
+  const decision = decideAccess({
+    pathname,
+    method: request.method,
+    role: request.auth?.user?.role,
+  });
 
-  if (!session?.user) {
-    if (isApi) {
-      return NextResponse.json({ error: 'Non authentifié' }, { status: 401 });
-    }
+  if (decision.kind === 'redirect') {
     const target = new URL('/login', request.nextUrl.origin);
     target.searchParams.set('from', pathname);
     return NextResponse.redirect(target);
   }
 
-  const isRead = request.method === 'GET' || request.method === 'HEAD';
-  if (!isRead && session.user.role !== 'admin') {
-    return NextResponse.json(
-      { error: 'Compte en lecture seule' },
-      { status: 403 },
-    );
+  if (decision.kind === 'deny') {
+    return NextResponse.json({ error: decision.error }, { status: decision.status });
   }
 
   return NextResponse.next();