feat(admin): affiliate/personal discounts, user-videos, internal routes, authz

Closes the remaining legacy-admin gaps:
- Users «مدیریت» modal: create personal discount or affiliate code (owner_user_id +
  owner_profit_percentage on existing /v1/discounts), and view the user's saved
  projects ("videos") via new admin GET /v1/saved-projects/by-user/{id} (studio)
- Internal routes admin (/admin/routes): CRUD on content.internal_routes
  (RoutesController + CmsService + gateway /v1/routes/*)
- Security: lock identity UsersController Search + Ban to [Authorize(Roles="Admin")]

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/components/admin/UserActions.tsx

@@ -20,6 +20,32 @@ export function UserActions({ row }: { row: Record<string, unknown>; reload?: ()
   const [seconds, setSeconds] = useState(""); const [renders, setRenders] = useState("");
   const [planDays, setPlanDays] = useState("");
   const [tags, setTags] = useState(""); const [note, setNote] = useState(""); const [status, setStatus] = useState("new");
+  // discount / affiliate
+  const [dcCode, setDcCode] = useState(""); const [dcKind, setDcKind] = useState("Percentage");
+  const [dcValue, setDcValue] = useState(""); const [dcProfit, setDcProfit] = useState(""); const [dcDays, setDcDays] = useState("30");
+  // videos
+  const [vids, setVids] = useState<Array<Record<string, unknown>> | null>(null);
+
+  const createDiscount = async () => {
+    setBusy(true); setMsg(null);
+    const expires = new Date(Date.now() + (Number(dcDays) || 30) * 864e5).toISOString();
+    const res = await fetch(`/api/admin/resource/discounts`, {
+      method: "POST", headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        name: dcCode || `user-${id.slice(0, 8)}`, code: dcCode, kind: dcKind, value: Number(dcValue) || 0,
+        owner_user_id: id, owner_profit_percentage: Number(dcProfit) || 0, expires_at: expires,
+      }),
+    });
+    const d = await res.json().catch(() => null);
+    setMsg(res.ok ? (Number(dcProfit) > 0 ? "کد افیلیت ساخته شد ✓" : "کد تخفیف ساخته شد ✓") : (d?.error?.message ?? d?.error ?? "خطا"));
+    setBusy(false);
+  };
+
+  const loadVideos = async () => {
+    const r = await fetch(`/api/admin/resource/saved-projects/by-user/${id}?pageSize=50`, { cache: "no-store" })
+      .then((x) => x.json()).catch(() => null);
+    setVids(r?.data ?? r?.items ?? (Array.isArray(r) ? r : []));
+  };
 
   const call = async (path: string, body: object, ok: string) => {
     setBusy(true); setMsg(null);
@@ -96,6 +122,41 @@ export function UserActions({ row }: { row: Record<string, unknown>; reload?: ()
                 </div>
               </div>
 
+              <div className={`${card} p-3`}>
+                <label className={lbl}>کد تخفیف / افیلیت (درصد سود &gt; ۰ یعنی افیلیت)</label>
+                <div className="grid gap-2 sm:grid-cols-2">
+                  <input className={inp} placeholder="کد" value={dcCode} onChange={(e) => setDcCode(e.target.value)} />
+                  <select className={inp} value={dcKind} onChange={(e) => setDcKind(e.target.value)}>
+                    <option value="Percentage">درصدی</option>
+                    <option value="FixedAmount">مبلغ ثابت</option>
+                    <option value="RenderCredits">اعتبار رندر</option>
+                  </select>
+                  <input className={inp} type="number" placeholder="مقدار" value={dcValue} onChange={(e) => setDcValue(e.target.value)} />
+                  <input className={inp} type="number" placeholder="٪ سود افیلیت" value={dcProfit} onChange={(e) => setDcProfit(e.target.value)} />
+                  <input className={inp} type="number" placeholder="اعتبار (روز)" value={dcDays} onChange={(e) => setDcDays(e.target.value)} />
+                </div>
+                <button className={`${btn} mt-2`} disabled={busy || !dcCode || !dcValue} onClick={createDiscount}>ساخت کد</button>
+              </div>
+
+              <div className={`${card} p-3`}>
+                <div className="flex items-center justify-between">
+                  <label className={lbl}>ویدیوهای کاربر</label>
+                  <button className="rounded-lg border border-[#262b40] px-2.5 py-1 text-xs text-gray-300 hover:bg-[#161a2e]" onClick={loadVideos}>بارگذاری</button>
+                </div>
+                {vids != null && (
+                  vids.length === 0 ? <p className="text-xs text-gray-500">ویدیویی یافت نشد.</p> : (
+                    <ul className="mt-1 max-h-40 space-y-1 overflow-y-auto text-sm text-gray-300">
+                      {vids.map((v) => (
+                        <li key={String(v.id)} className="flex items-center justify-between rounded bg-[#0c0e1a] px-2 py-1">
+                          <span className="truncate">{String(v.name ?? v.original_project_name ?? "—")}</span>
+                          <span className="text-[11px] text-gray-500">{String(v.type ?? "")} · {String(v.resolution ?? "")}</span>
+                        </li>
+                      ))}
+                    </ul>
+                  )
+                )}
+              </div>
+
               <div className={`${card} p-3`}>
                 <label className={lbl}>یادداشت CRM</label>
                 <div className="grid gap-2">

src/components/admin/admin-resources.tsx

@@ -235,6 +235,26 @@ export const commentsConfig: ResourceConfig = {
   },
 };
 
+export const routesConfig: ResourceConfig = {
+  title: "Internal Routes",
+  description: "Curated internal routes / featured links (slug, image, priority).",
+  basePath: "routes",
+  canCreate: true,
+  canEdit: true,
+  canDelete: true,
+  columns: [
+    { key: "name", label: "Name" },
+    { key: "slug", label: "Slug" },
+    { key: "priority", label: "Priority" },
+  ],
+  fields: [
+    { key: "slug", label: "Slug (path)", required: true },
+    { key: "name", label: "Name" },
+    { key: "image", label: "Image", type: "image" },
+    { key: "priority", label: "Priority", type: "number" },
+  ],
+};
+
 export const usersConfig: ResourceConfig = {
   title: "Users",
   description: "Accounts in this tenant. Ban or unban below.",