Refine admin workflows and team access

Backend/Security/AdminPermissionCatalog.cs

@@ -58,7 +58,7 @@ public static class AdminPermissionCatalog
         {
             AdminRoles.Owner => AllPermissionKeys,
             AdminRoles.Creator => AllPermissionKeys,
-            AdminRoles.Admin => AllPermissionKeys.Where(key => key is not Settings).ToArray(),
+            AdminRoles.Admin => AllPermissionKeys,
             AdminRoles.Member => [Dashboard, Nominations, Categories, Candidates, Clips, Content],
             AdminRoles.Reviewer => [Dashboard, Nominations, Clips, Risk, Audit],
             AdminRoles.OrganizationTeam => [Dashboard, Content, Analytics, Winners, Settings],
@@ -67,6 +67,30 @@ public static class AdminPermissionCatalog
         };
     }
 
+    public static string[] NormalizePermissionKeys(string? role, IEnumerable<string> permissionKeys)
+    {
+        var normalizedRole = AdminRoles.Normalize(role);
+        var permissions = permissionKeys
+            .Where(IsKnownPermission)
+            .Distinct(StringComparer.OrdinalIgnoreCase)
+            .ToList();
+
+        if (normalizedRole is AdminRoles.Owner or AdminRoles.Creator)
+        {
+            return AllPermissionKeys;
+        }
+
+        if (DefaultPermissionKeys(normalizedRole).Contains(Settings, StringComparer.OrdinalIgnoreCase)
+            && !permissions.Contains(Settings, StringComparer.OrdinalIgnoreCase))
+        {
+            permissions.Add(Settings);
+        }
+
+        return permissions
+            .OrderBy(item => item)
+            .ToArray();
+    }
+
     public static async Task<string[]> GetPermissionKeysAsync(
         AwardsDbContext db,
         string? role,
@@ -92,11 +116,7 @@ public static class AdminPermissionCatalog
 
         try
         {
-            return (JsonSerializer.Deserialize<string[]>(overrideJson) ?? fallback)
-                .Where(IsKnownPermission)
-                .Distinct(StringComparer.OrdinalIgnoreCase)
-                .OrderBy(item => item)
-                .ToArray();
+            return NormalizePermissionKeys(normalizedRole, JsonSerializer.Deserialize<string[]>(overrideJson) ?? fallback);
         }
         catch (JsonException)
         {