Declare role requirements per controller

RoleRequired supplies require_redaktion and require_admin for surfaces that
are not nodes and so cannot be reached by Node#restricted?.

Navigation is content rather than plumbing, so menu_items requires
redaktion. User management is janitorial and requires admin: index, new,
create, reset_otp, deactivate, reactivate. verify_status now also covers
show, without which any logged-in user could read any account by walking a
small id space. Editing your own account stays open.

The dashboard hides the Users and Navigation buttons from those who cannot
use them; everything else stays visible to everyone. Both denials share one
message and land on the dashboard.

Adds redella (redaktion) and alufa (redaktion + alumni) fixtures.

1 files changed, 2 insertions, 0 deletions

diff --git a/config/locales/en.yml b/config/locales/en.yml
index c23f2c33..2f7ac72f 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -533,6 +533,8 @@ en:
       headline_ineligible: "This asset type cannot be a headline."
       locked_by_other: "The page is locked by another editor."
       autosave_failed: "Autosave failed"
+      redaktion_required: "This page is reserved for Redaktion."
+      admin_required: "This page is reserved for administrators."
     sessions:
       otp_setup_now: "Your account requires a second factor -- set it up now."
       logged_out: "You have been logged out."