CRITICAL: is_any_staff_member() grants platform-wide admin to any org owner
Imported from GitHub issue El-SaMa/oma#94 by @El-SaMa.
Severity: Critical — active in production
`is_any_staff_member()` (used by ~18 RLS policies: enhance_credentials, hetzner_settings root passwords, billing_settings, support_mail_*, enhance_db_node_credentials, etc.) checks `memberships.role IN ('owner','admin','staff')` with no organization filter. Any customer who owns their own hosting org (the normal state via `organizations.owner_user_id`) passes this check and gets platform-wide staff access to every other customer's data.
App-layer equivalent (`resolveRoleForUser` in `apps/web/lib/roles.ts`) had the identical bug.
Fix drafted, not yet deployed:
- `packages/db/migrations/0053_fix_staff_role_scope.sql` — redefines `is_any_staff_member()` to check membership in one specific staff org UUID (Lanetti, `edb40deb-e0ac-49f6-ab39-1efee07831a7`)
- `apps/web/lib/roles.ts` — `resolveRoleForUser` now scoped to `STAFF_ORGANIZATION_ID`
Prerequisite: the platform operator (`[email protected]`) must be added as `owner` of the Lanetti org first, or this fix locks out the operator's own admin access (neither `OMA_STAFF_EMAILS` nor `OMA_STAFF_ORGANIZATION_ID` is set in production, so admin access currently depends entirely on the same unscoped membership lookup).
Exposure: currently 13 real customer accounts have unintended `owner`-role-driven staff access.