Safer changes to Admin and Finance access

Admin and Finance access now receives the same protection everywhere it can be changed,
including staff profiles, bulk actions, invitations, collaboration tools, background jobs,
and AI-assisted staff management.

Changing, suspending, restoring, or removing this protected access requires another active
venue administrator who is allowed to manage permissions. People cannot grant themselves
protected access or remove their own last administrative path. Ordinary staff role changes
continue to work as before.

If an older background task or collaboration request cannot prove who authorized a protected
change, it now stops safely and asks for an authorized administrator to complete the change
from Staff management.