v1.8.23: remove upload from homepage, restore single+bulk in library for admin/librarian only

static/library.html

@@ -598,6 +598,25 @@ let uploadFile = null;
 let searchTimer = null;
 let favIds = new Set();
 
+// ── Auth init — populate currentUser and show upload for admin/librarian ──
+(async function() {
+  const tok = localStorage.getItem('rag_token');
+  if (!tok) return;
+  try {
+    const r = await fetch('/auth/me', { headers: { 'Authorization': 'Bearer ' + tok } });
+    if (!r.ok) return;
+    currentUser = await r.json();
+    const role = currentUser.role || '';
+    const perms = currentUser.permissions || [];
+    const canUpload = perms.includes('upload') || role === 'admin' || role === 'librarian';
+    if (canUpload) {
+      const wrap = document.getElementById('upload-btn-wrap');
+      if (wrap) wrap.classList.remove('hidden');
+    }
+  } catch(e) {}
+})();
+
+
 async function loadFavIds() {
   if (!userToken) return;
   try {