fix: limit self approval to admins

backend/src/main/java/com/itcenter/acs/controller/VisitRequestController.java

@@ -37,15 +37,15 @@ public class VisitRequestController {
     /**
      * Create pre-registration(s); current user becomes the host. One request is issued per
      * selected server room, so the response may contain more than one (e.g. 4층+5층전산실 → 2건).
-     * When the registrant already holds approval authority (ADMIN/SECURITY), each request is
-     * self-approved immediately (QR issued) — HOST registrations stay PENDING.
+     * When the registrant is ADMIN, each request is self-approved immediately
+     * (QR issued) — SECURITY/HOST registrations stay PENDING.
      */
     @PostMapping
     public ResponseEntity<ApiResponse<List<VisitRequestResponse>>> create(
             @Valid @RequestBody VisitRequestCreateRequest request) {
         Long userId = SecurityUtils.currentUserId();
         List<VisitRequest> created = visitRequestService.createRequests(request, userId);
-        if (SecurityUtils.hasRole("ADMIN") || SecurityUtils.hasRole("SECURITY")) {
+        if (SecurityUtils.hasRole("ADMIN")) {
             List<VisitRequest> approved = new java.util.ArrayList<>(created.size());
             for (VisitRequest vr : created) {
                 approved.add(approvalService.approve(vr.getId(), userId, "본인 등록 자동승인"));

server/routes/business.ts

@@ -273,7 +273,7 @@ async function retryPassDelivery(dbQuery: QueryFn, deliveryId: number) {
 }
 
 function canSelfApprove(user: UserRow): boolean {
-  return user.roles.includes('ADMIN') || user.roles.includes('SECURITY');
+  return user.roles.includes('ADMIN');
 }
 
 async function approveVisit(dbQuery: QueryFn, visitId: number, actor: UserRow, comment: string | null): Promise<VisitRow> {