Gate live-content changes on restricted surfaces

publish_draft!, trash!, destroy_from_trash!, attach_asset! and
Asset#destroy_witnessed! now refuse unless the acting user holds redaktion,
and only when the subject is on a restricted surface: the front page, the
updates tree that feeds ~100k subscribers, or disclosure. Drafting,
autosaving, tagging and creating stay free everywhere for everyone.

Enforcement is in the models rather than the controllers, since attach_asset!
and the rest are reachable from rake tasks and internal paths. It follows the
errors.add-plus-bare-raise pattern the rest of Node already uses, so every
existing RecordInvalid rescue reports it with a localised message; only
assets_controller#destroy needed a rescue added.

A nil user is treated as a system context and bypasses the gate. The default
nil on three of those verbs is what makes that reachable, and removing those
defaults once every call site passes a user is the next tightening.

2 files changed, 6 insertions, 0 deletions

diff --git a/config/locales/de.yml b/config/locales/de.yml
index 8aae7ca5..a7ad0f26 100644
--- a/config/locales/de.yml
+++ b/config/locales/de.yml
@@ -145,6 +145,7 @@ de:
               restore_target_invalid: "Das Wiederherstellungsziel muss ein lebender Node sein"
               destroy_outside_trash: "Nodes können nur aus dem Papierkorb gelöscht werden"
               attach_in_trash: "An einen Node im Papierkorb können keine Assets angehängt werden"
+              not_permitted: "In diesem Bereich dürfen nur Mitglieder der Redaktion veröffentlichte Inhalte ändern"
         user:
           attributes:
             roles:
@@ -153,6 +154,10 @@ de:
           attributes:
             headline:
               images_and_pdfs_only: "kann nur auf Bildern oder PDFs gesetzt werden"
+        asset:
+          attributes:
+            base:
+              not_permitted: "Dieses Asset ist an geschützte Seiten angehängt; nur die Redaktion darf es löschen"
 
   tags:
     index:
diff --git a/config/locales/en.yml b/config/locales/en.yml
index e434538f..7e830325 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -92,6 +92,7 @@ en:
               restore_target_invalid: "Restore target must be a living node"
               destroy_outside_trash: "Nodes are only destroyed from the Trash"
               attach_in_trash: "Cannot attach assets to a node in the Trash"
+              not_permitted: "Only Redaktion members may change published content in this section"
         user:
           attributes:
             roles: