feat(posts-api): assegna autore in POST, ownership su PUT/DELETE

src/lib/posts.ts

@@ -76,3 +76,8 @@ export function listArchiveMonths(db: Database.Database): { month: string; count
 export function listByAuthor(db: Database.Database, authorId: number): Post[] {
   return db.prepare('SELECT * FROM posts WHERE author_id = ? ORDER BY updated_at DESC').all(authorId) as Post[];
 }
+
+export function canModifyPost(role: string, userId: number, post: { author_id: number | null }): boolean {
+  if (role === 'admin' || role === 'superuser') return true;
+  return post.author_id === userId;
+}