feat(api): per-map edit permissions + protected maps + attribution (#4)

[Aduersarius]

Summary

Resolves #4 — Etapa 0 permissions and attribution for map editing.

What landed

• requireMapEditSession: same GAME_DATA_ADMIN_PROXY_TOKEN gate; superadmin via email/account; collaborators via game_map_permissions (map_num or 0 = all non-protected).
• Protected cities {1, 34, 59, 150}: rejected for everyone unless superadmin sends x-protected-map-override: true.
• Attribution: game_map_mutation_log records who/what/when on paint, clear, entities, publish, discard, revert, grant/revoke (complements updated_by_account_id on row writes).
• Admin APIs: grant/revoke/list map permissions.
• Docs: GAME_DATA_ADMIN_* in api/.env.example.
• Tests: npx tsx --test src/tests/mapEditPermissions.test.ts → 6/6 covering all four acceptance cases as pure decision logic.

Differentiation vs open PRs

PR	Gap
#110	Always passes isSuperAdmin: true — collaborators never work; no DB grants table; contaminated with graceful-shutdown unrelated files
#129	Close, but override via body/query is inconsistent; no dedicated mutation audit log; decision logic not unit-tested in isolation
#47	Parallel services/map-permissions.ts with fictional assignedMaps; not wired to real admin/session or map routes

This PR keeps permission decision pure (mapEditPermissions.ts), persists grants + audit in schema, and wires every map mutation route consistently via one header.

Test plan

• cd api && npx tsx --test src/tests/mapEditPermissions.test.ts (6/6)
• Apply api/schema.sql (game_map_permissions, game_map_mutation_log)
• Session without grant → PUT .../maps/50/tiles → 403
• Grant map 50 only → can edit 50, cannot edit 1 or 2
• Superadmin without override on map 1 → 403; with x-protected-map-override: true → ok
• After paint/publish, row appears in game_map_mutation_log

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar