refactor(auth): simplify authorization checks to use membership only

- Remove explicit ADMIN role checks in API handlers
- Replace combined creator/member role checks with membership-only filters
- Update seed data roles to reflect changed authorization logic
- Add migration to insert hunt creators as members for consistent checks
- Prevent removal of hunt creator as a member with new explicit check
- Adjust related user role updates and queries accordingly
- Upgrade dependencies including nuxt and zod for compatibility

prisma/migrations/20260730000000_add_creators_as_hunt_members/migration.sql

@@ -0,0 +1,8 @@
+-- Add hunt creators as HuntMembers so authorization only needs membership check
+INSERT INTO "HuntMember" ("huntId", "memberId", "createdAt")
+SELECT h."id", h."creatorId", NOW()
+FROM "Hunt" h
+WHERE NOT EXISTS (
+  SELECT 1 FROM "HuntMember" hm
+  WHERE hm."huntId" = h."id" AND hm."memberId" = h."creatorId"
+);

prisma/seed/hunt.ts

@@ -14,7 +14,7 @@ async function main() {
       create: {
         email: 'admin@mail.com',
         name: 'Admin user',
-        role: 'ADMIN',
+        role: 'CREATOR',
         password,
         emailConfirmedAt: new Date()
       }
@@ -25,7 +25,7 @@ async function main() {
       create: {
         email: 'team@mail.com',
         name: 'Hunt member',
-        role: 'ADMIN',
+        role: 'USER',
         password,
         emailConfirmedAt: new Date()
       }
@@ -202,6 +202,9 @@ async function main() {
         creatorId: admin.id,
         members: {
           create: [
+            {
+              memberId: admin.id
+            },
             {
               memberId: huntMember.id
             }