v1.1.0-beta.039 - feat(permissions): request gate, per-library access, themed tiers, default-access
🛡️ Per-library access control
- library-access chokepoint enforced across every read surface (library/{route,series,issue,recent,check,ids}, discover, calendar, recommendations, reader/image, opds/, reading-lists/) — non-admins see only granted libraries (fresh DB lookup, not JWT)
- New UserLibraryAccess grants; admin/users gains per-library checkboxes; new admin/libraries route backs the picker
- reader/image hardened against path traversal via shared isPathWithinRoots() (utils/paths)
🦸 Themed tiers + request gate
- canRequest gate on request/route, request/manual, reading-lists import/fallback — Civilian → 403, admins bypass
- Tiers (Civilian/Sidekick/Vigilante/Hero) via tier-badge in admin/users, site-header, profile; Apply-Tier + per-library grants in users admin
- Auth seeding: register + SSO users get default-library access + canRequest; flows through JWT/session (next-auth.d.ts)
🔓 Per-library default access
- Library.defaultAccess "Auto-grant to all users" toggle in Settings; admin/config grants newly-default libraries to all users on false→true
- db-init one-time sentinel-guarded backfills: canRequest for existing users, all-library access for existing users, Comics flagged default-access
🔧 SQLite adaptation
- Replaced createMany skipDuplicates (Postgres-only) with existing-pair filtering in the default-access grant + library backfill
✅ Verification
- tsc --noEmit clean; vitest 210/210 across 63 files (8 permission suites updated)