v1.7.1: 멤버 권한·추천 사이트·네비게이션 UI 개선

관리자는 VIP·멤버만 수정 가능하도록 서버·UI 권한을 정리하고 소유자 권한 이전 API와 확인 모달을 추가했다. 추천 사이트 파비콘 캐시·URL 접두사·카드 편집 UI를 보강하고 확인 얼럿을 AdminConfirmModal로 통일했다.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/routes/admin/api/members/[id]/password.put.js

@@ -2,7 +2,7 @@ import bcrypt from 'bcrypt'
 import { createError, getRouterParam, readBody } from 'h3'
 import { z } from 'zod'
 import { requireAdminSession } from '../../../../../utils/admin-auth'
-import { getMemberForAdmin, updateMemberPassword } from '../../../../../repositories/member-repository'
+import { getMemberForAdmin, updateMemberPassword, assertActorCanEditMemberProfile } from '../../../../../repositories/member-repository'
 
 const adminMemberPasswordSchema = z.object({
   password: z.string().min(8).max(32)
@@ -14,7 +14,7 @@ const adminMemberPasswordSchema = z.object({
  * @returns {Promise<{ ok: true }>} 변경 결과
  */
 export default defineEventHandler(async (event) => {
-  requireAdminSession(event)
+  const session = requireAdminSession(event)
   const memberId = String(getRouterParam(event, 'id') || '')
   const parsedBody = adminMemberPasswordSchema.safeParse(await readBody(event))
 
@@ -32,6 +32,11 @@ export default defineEventHandler(async (event) => {
     })
   }
 
+  await assertActorCanEditMemberProfile({
+    actorUserId: session.userId,
+    targetUserId: memberId
+  })
+
   const member = await getMemberForAdmin(memberId)
   if (!member) {
     throw createError({