fix(admin): remove redundant confirmations and repair code access

frontend/src/app/api/admin/codes/[id]/route.ts

@@ -28,7 +28,7 @@ export async function PATCH(
   try {
     const session = await requireAdminMutation(
       request,
-      "billing.adjustments.write",
+      "admin.access",
     );
     const parsedParams = paramsSchema.safeParse(await context.params);
     const parsedBody = updateCodeSchema.safeParse(
@@ -64,7 +64,7 @@ export async function DELETE(
   try {
     const session = await requireAdminMutation(
       request,
-      "billing.adjustments.write",
+      "admin.access",
     );
     const parsed = paramsSchema.safeParse(await context.params);
     if (!parsed.success) return invalidQueryResponse();

frontend/src/app/api/admin/codes/route.ts

@@ -64,7 +64,7 @@ function serializedCodeRow(row: CodeRow) {
 
 export async function GET(request: Request) {
   try {
-    await requirePermission("billing.orders.read");
+    await requirePermission("admin.access");
     const parsed = parseListQuery(request);
     if (!parsed.success) return invalidQueryResponse(parsed.error.flatten());
     const { page, pageSize, sort, order, q, status } = parsed.data;
@@ -124,7 +124,7 @@ export async function POST(request: Request) {
   try {
     const session = await requireAdminMutation(
       request,
-      "billing.adjustments.write",
+      "admin.access",
     );
     const parsed = createCodesSchema.safeParse(
       await request.json().catch(() => null),