feat: photo-search, system settings, ROADMAP

- PhotoSearchModal: Yandex photo-search с профилями доменов
- SystemSettings: управление app_settings (admin-only, /system)
- ROADMAP.md: актуальный план фич P1-P10
- Header, ChannelView, session: поддержка is_admin

lib/engine.js

@@ -21,7 +21,10 @@ async function call(path, options = {}) {
   });
   if (!res.ok) {
     const err = await res.json().catch(() => ({ error: res.statusText }));
-    throw new Error(err.error || `Engine ${res.status}`);
+    const e = new Error(err.error || `Engine ${res.status}`);
+    e.status = res.status;
+    e.code = err.code;
+    throw e;
   }
   return res.json();
 }
@@ -52,4 +55,17 @@ export const engine = {
   updatePost: (userId, id, data) => call(`/api/user-posts/${id}`, { userId, method: 'PATCH', body: data }),
   deletePost: (userId, id) => call(`/api/user-posts/${id}`, { userId, method: 'DELETE' }),
   publishPost: (userId, id) => call(`/api/user-posts/${id}/publish`, { userId, method: 'POST' }),
+
+  // Photo search
+  photoSearchProfiles: () => call('/api/photo-search/profiles'),
+  photoSearchQuota:    () => call('/api/photo-search/quota'),
+  photoSearchByQuery:  (data) => call('/api/photo-search/by-query', { method: 'POST', body: data }),
+
+  // Settings (admin)
+  listSettings:   (category) => {
+    const qs = category ? `?category=${encodeURIComponent(category)}` : '';
+    return call(`/api/settings/admin${qs}`);
+  },
+  updateSetting:  (key, value) => call(`/api/settings/admin/${encodeURIComponent(key)}`, { method: 'PUT', body: { value } }),
+  invalidateSettingsCache: () => call('/api/settings/admin/invalidate', { method: 'POST' }),
 };

lib/session.js

@@ -20,5 +20,11 @@ export async function getSession() {
 export async function requireUser() {
   const s = await getSession();
   if (!s.userId) return null;
-  return { id: s.userId, email: s.email, name: s.name };
+  return { id: s.userId, email: s.email, name: s.name, isAdmin: !!s.isAdmin };
+}
+
+export async function requireAdmin() {
+  const u = await requireUser();
+  if (!u || !u.isAdmin) return null;
+  return u;
 }