fix(ops): route area-lead roster writes through server actions (SoC)

The ops UI created/updated/deleted area_leads directly from the browser (the
delete had no admin gate or space scope). Add createAreaLead/updateAreaLead/
deleteAreaLead (admin-gated, space-scoped, validated, audited) and wire the
modal + delete handler to them, dropping the direct browser writes. The
distinct area_code-keyed upsertAreaLead interface is left untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/validations/permissions.ts

@@ -28,3 +28,15 @@ export const assignAreaLeadSchema = z.object({
   area_lead_role_id: z.string().uuid('Invalid role ID'),
   member_id: z.string().uuid('Invalid member ID'),
 })
+
+// The ops-managed area-lead roster (area_name-keyed, distinct from the
+// area_code-keyed upsertAreaLead role interface above).
+export const createAreaLeadSchema = z.object({
+  area_name: z.string().min(1).max(100),
+  lead_handle: z.string().min(1).max(100),
+  description: z.string().max(2000).optional().nullable(),
+})
+
+export const updateAreaLeadSchema = createAreaLeadSchema.extend({
+  id: z.string().uuid('Invalid area lead ID'),
+})