v1.5 - history and timeline as well as many datastructure updates added, polished, fixes

src/pages/admin/EntityList.tsx

@@ -4,6 +4,12 @@
    One component for organizations, events and people. The :entity
    route param picks the manifest; nothing here knows what a
    chapter or a retreat is.
+
+   The "New X" link follows the same rule as EntityEdit's save
+   button: atLeast(user, "editor"), matching requireRole("editor")
+   on POST /api/admin/:entity. Drawing it is not permission — the
+   server decides — it only avoids offering a click that 403s, and
+   avoids hiding one that wouldn't.
    ═══════════════════════════════════════════════════════════════ */
 
 import { useCallback, useEffect, useState } from "react";
@@ -12,6 +18,7 @@ import { Link, useNavigate, useParams, useSearchParams } from "react-router-dom"
 import { get, ApiError } from "../../lib/api.js";
 import { isUnauthorized, useAuth } from "../../lib/auth.tsx";
 import { ADMIN_ENTITIES } from "../../lib/adminSchema.js";
+import { atLeast } from "../../lib/roles.ts";
 
 export default function EntityList() {
   const { entity: entityKey } = useParams();
@@ -26,7 +33,12 @@ export default function EntityList() {
   const [error, setError] = useState(null);
   const [query, setQuery] = useState(params.get("q") ?? "");
 
-  const canWrite = user?.role === "admin";
+  // Minimum rank, never equality. POST /api/admin/:entity is gated
+  // at "editor", so anyone from editor upward may create — and the
+  // equality test this replaced hid the button from superadmins as
+  // well as editors, which is the failure mode an == against a
+  // ladder always produces once a rank is added above it.
+  const canWrite = atLeast(user, "editor");
 
   const load = useCallback(async () => {
     if (!manifest) return;