refactor(auth): simplify authorization checks to use membership only

- Remove explicit ADMIN role checks in API handlers
- Replace combined creator/member role checks with membership-only filters
- Update seed data roles to reflect changed authorization logic
- Add migration to insert hunt creators as members for consistent checks
- Prevent removal of hunt creator as a member with new explicit check
- Adjust related user role updates and queries accordingly
- Upgrade dependencies including nuxt and zod for compatibility

server/api/admin/team/[teamId]/add.post.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { teamId } = await useValidatedParams(
     event,
     z.object({
@@ -29,18 +22,11 @@ export default defineEventHandler(async (event) => {
     where: {
       id: teamId,
       hunt: {
-        OR: [
-          {
-            creatorId: user.user.id
-          },
-          {
-            members: {
-              some: {
-                memberId: user.user.id
-              }
-            }
+        members: {
+          some: {
+            memberId: user.user.id
           }
-        ]
+        }
       }
     },
     select: {

server/api/admin/team/[teamId]/index.delete.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { teamId } = await useValidatedParams(
     event,
     z.object({
@@ -23,18 +16,11 @@ export default defineEventHandler(async (event) => {
       where: {
         id: teamId,
         hunt: {
-          OR: [
-            {
-              creatorId: user.user.id
-            },
-            {
-              members: {
-                some: {
-                  memberId: user.user.id
-                }
-              }
+          members: {
+            some: {
+              memberId: user.user.id
             }
-          ]
+          }
         }
       }
     });

server/api/admin/team/[teamId]/kick.post.ts

@@ -4,13 +4,6 @@ import prisma from '~~/lib/prisma';
 export default defineEventHandler(async (event) => {
   const user = await requireUserSession(event);
 
-  if (user.user.role !== 'ADMIN') {
-    throw createError({
-      status: 403,
-      statusText: 'Not allowed!'
-    });
-  }
-
   const { teamId } = await useValidatedParams(
     event,
     z.object({
@@ -34,18 +27,11 @@ export default defineEventHandler(async (event) => {
         },
         team: {
           hunt: {
-            OR: [
-              {
-                creatorId: user.user.id
-              },
-              {
-                members: {
-                  some: {
-                    memberId: user.user.id
-                  }
-                }
+            members: {
+              some: {
+                memberId: user.user.id
               }
-            ]
+            }
           }
         }
       },