feat(billing): Credits Manager role lets Operators issue and revoke credit grants [urgent]

[ctkm-aelf]

Priority: urgent. We need non-admins (Operators) to be able to grant credits without giving them full platform Admin.

What changes

• New system role: Credits Manager (credits_manager), seeded at startup, with permission nyxid:billing:credit_grants:write.
• New check: require_credit_grant_manager (handlers/admin_helpers.rs) passes for every Admin, and for an Operator whose direct or group roles carry that permission. Regular users holding the role are still refused.
• Guarded endpoints: POST /admin/credits/grants and DELETE /admin/credits/grants/{id} now use that check. Allowances and recurring schedules stay admin-only. Credit list endpoints are unchanged (Operators could already read them).
• GET /users/me: adds capabilities.manage_credit_grants. This is an additive field; older frontends ignore it.
• Admin → Credits: "Issue grant" and revoke controls follow canManageCreditGrants. Allowance and schedule controls keep canAdminWrite.

No new environment variables and no migration. The role is created by the existing system-role seed.

How to use it

An Admin assigns Credits Manager to a user who is already an Operator, in Admin → Users → Roles. The Operator sees grant controls after their next page load. Revoking works from the same Roles section: it previously hid Revoke for every system role, and now hides it only for the Admin, Operator and User platform roles.

Tests

• credits_manager_operator_issues_and_revokes_grants_only:
  • an Operator with the role passes authorization on issue and revoke;
  • the same Operator is still refused allowances;
  • a regular user holding the role is refused.
• The existing operator_reads_credit_admin_surfaces_but_cannot_mutate_them still passes, so a plain Operator stays read-only.
• Frontend: canManageCreditGrants unit tests.
• Local runs:
  • cargo test -p nyxid --bin nyxid-server -- billing_credits role_service handlers::users: 58 passed.
  • Vitest on types/api.test.ts and admin-credits-safety.test.tsx: passed.
  • tsc and eslint: clean.

🤖 Generated with Claude Code

[github-actions]

📊 Code coverage

Component	Lines	Threshold	Status	Δ vs base
Backend (nyxid)	87.06%	73%	✅	— 0.00
Frontend (vitest)	72.27%	15%	✅	🔺 +0.01

Gate: line coverage must stay at or above the threshold. Ratchet plan (W21): Backend → 55%, CLI → 50%, Frontend → 30% by quarter end.