fix: idor checks on all exposed endpoints

src/routes/api/matches/[id]/rolling/+server.ts

@@ -1,10 +1,11 @@
 // src/routes/api/matches/[id]/rolling/+server.ts
 import { json, error } from '@sveltejs/kit';
 import { moveToRolling } from '$lib/server/match/engine';
+import { requireRole } from '$lib/server/permissions';
 import type { RequestHandler } from './$types';
 
 export const POST: RequestHandler = async ({ params, locals }) => {
-	if (!locals.user) error(401, 'Not logged in');
+	requireRole(locals, 'referee', 'Only referees or admins can move matches to rolling');
 
 	try {
 		const m = await moveToRolling(params.id);