refactor: add withRules wrapper to API routes Use withRules to enforce permissions instead of manual checks. Remove FORBIDDEN constant, simplify handlers, import withRules, adjust GET/POST/PUT/DELETE handlers. Centralizes auth logic. refactor: replace manual auth checks with withRules wrapper for routes refactor(student routes): replace manual employee checks with withRules wrapper
- GET /promotions/{idPromo} returns promotion or 404 - PUT /promotions/{idPromo} updates year or 404 - DELETE /promotions/{idPromo} deletes promotion or 404 - Only employees allowed, otherwise 403
djalim