fix(ops): route area-lead roster writes through server actions (SoC)

The ops UI created/updated/deleted area_leads directly from the browser (the
delete had no admin gate or space scope). Add createAreaLead/updateAreaLead/
deleteAreaLead (admin-gated, space-scoped, validated, audited) and wire the
modal + delete handler to them, dropping the direct browser writes. The
distinct area_code-keyed upsertAreaLead interface is left untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

app/(app)/ops/components/area-lead-modal.tsx

@@ -1,9 +1,8 @@
 'use client'
 
 import { useState } from 'react'
-import { createClient } from '@/lib/supabase/client'
+import { createAreaLead, updateAreaLead } from '@/lib/actions'
 import { toast } from 'sonner'
-import type { TablesInsert, TablesUpdate } from '@/types/database'
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog'
 import type { AreaLead } from '../types'
 
@@ -12,12 +11,10 @@ export function AreaLeadModal({
   lead,
   onClose,
   onSaved,
-  spaceId,
 }: {
   lead: AreaLead | null
   onClose: () => void
   onSaved: (l: AreaLead) => void
-  spaceId: string
 }) {
   const isEdit = !!lead
   const [areaName, setAreaName] = useState(lead?.area_name ?? '')
@@ -29,26 +26,16 @@ export function AreaLeadModal({
     e.preventDefault()
     if (!areaName.trim() || !memberName.trim()) return
     setSaving(true)
-    const supabase = createClient()
-    let result
-    if (isEdit) {
-      result = await supabase.from('area_leads').update({
-        area_name: areaName.trim(),
-        lead_handle: memberName.trim(),
-        description: contactInfo.trim() || null,
-        // TODO(types): remove `as never` after regenerating types/database.ts (missing FK relationship metadata)
-      } satisfies TablesUpdate<'area_leads'> as never).eq('id', lead.id).select('*').single()
-    } else {
-      result = await supabase.from('area_leads').insert({
-        space_id: spaceId,
-        area_name: areaName.trim(),
-        lead_handle: memberName.trim(),
-        description: contactInfo.trim() || null,
-        // TODO(types): remove `as never` after regenerating types/database.ts (missing FK relationship metadata)
-      } satisfies TablesInsert<'area_leads'> as never).select('*').single()
+    const fields = {
+      area_name: areaName.trim(),
+      lead_handle: memberName.trim(),
+      description: contactInfo.trim() || null,
     }
+    const result = isEdit
+      ? await updateAreaLead(lead.id, fields)
+      : await createAreaLead(fields)
     setSaving(false)
-    if (result.error) { toast.error(result.error.message); return }
+    if ('error' in result) { toast.error(result.error); return }
     toast.success(isEdit ? 'Area lead updated' : 'Area lead added')
     onSaved(result.data as AreaLead)
     onClose()

app/(app)/ops/ops-client.tsx

@@ -2,7 +2,7 @@
 
 import { useState, useMemo } from 'react'
 import { Plus, Search, Lock, Users2 } from 'lucide-react'
-import { createClient } from '@/lib/supabase/client'
+import { deleteAreaLead } from '@/lib/actions'
 import { toast } from 'sonner'
 import { PageTitle } from '@/components/ui/page-title'
 import { KbModal } from './components/kb-modal'
@@ -15,7 +15,7 @@ import { TABS } from './types'
 import type { OpsClientProps, Tab, KbEntry, AreaLead, Secret } from './types'
 
 // ─── Main Component ────────────────────────────────────────────────────────────
-export function OpsClient({ spaceId, kbEntries: initial, areaLeads: initialLeads, secrets: initialSecrets, canSeeSecrets, canManageAcl = false, aclRoleOptions = [], aclByEntity = {} }: OpsClientProps) {
+export function OpsClient({ kbEntries: initial, areaLeads: initialLeads, secrets: initialSecrets, canSeeSecrets, canManageAcl = false, aclRoleOptions = [], aclByEntity = {} }: OpsClientProps) {
   const [activeTab, setActiveTab] = useState<Tab>('kb')
   const [search, setSearch] = useState('')
   const [kbEntries, setKbEntries] = useState<KbEntry[]>(initial)
@@ -64,9 +64,8 @@ export function OpsClient({ spaceId, kbEntries: initial, areaLeads: initialLeads
   }, [areaLeads, search])
 
   async function deleteLeadFn(id: string) {
-    const supabase = createClient()
-    const { error } = await supabase.from('area_leads').delete().eq('id', id)
-    if (error) { toast.error(error.message); return }
+    const result = await deleteAreaLead(id)
+    if ('error' in result) { toast.error(result.error); return }
     setAreaLeads(prev => prev.filter(l => l.id !== id))
     toast.success('Area lead removed')
   }
@@ -221,7 +220,6 @@ export function OpsClient({ spaceId, kbEntries: initial, areaLeads: initialLeads
                 : [...prev, saved].sort((a, b) => a.area_name.localeCompare(b.area_name)),
             )
           }}
-          spaceId={spaceId}
         />
       )}
     </div>